Merge pull request #744 from AssetOverflow/codex/epistemic-coherence-finding

docs: epistemic-coherence finding (speculative ceiling ≠ learning block) + proof-carrying-wiring scope

docs/analysis/epistemic-coherence-architecture-2026-06-14.md

@@ -0,0 +1,91 @@
+# Finding: the speculative epistemic ceiling does NOT blunt learning
+
+**Date:** 2026-06-14
+**Status:** substrate finding (refutes a compelling-but-wrong intuition; corrects
+the "B1 coherent-promotion" plan). Method: 7-agent architecture audit + adversarial
+verification (run `wf_f7c37d46-16f`).
+**TL;DR:** All cognition/logos pack entries are `speculative`, and the engine's
+`determine` path can never label a conclusion `verified` — but **neither fact
+blunts learning**. The speculative state is an *honesty/disclosure* mechanism, by
+design, and the reasoning/learning loop is blind to it. The plan to "promote
+entries to coherent so the model can learn" is unwarranted; the lexicon variant is
+purely cosmetic and the fact variant risks manufacturing false `verified`.
+
+## The question
+
+Audit found 25/28 packs have no `epistemic_status` (→ default `speculative`), and
+`generate/determine/determine.py::_basis` only returns `"verified"` when every
+ground is `coherent`. Hypothesis: this caps the model and is why it underperforms
+at learning from contemplation/practice. **Tested rigorously. Refuted.**
+
+## What is actually true (verified, high confidence)
+
+### Axis A — promoting a *lexicon* entry to coherent is compile-and-display-only
+- `language_packs/compiler.py:75-92` maps a `coherent` lexical row → `EpistemicState.DECODED`,
+  stored per-surface on the manifold (`compiler.py:357` → `vocab/manifold.py:114`).
+- **No reasoning/recall/realize/learning path reads that tag.** The only non-test
+  reads (`compiler.py:406`, `:559`) merely copy it forward; `workbench/logos.py`
+  reads it for the Studio audit badge (display).
+- The runtime's per-turn epistemic state comes from **`grounding_source`**, not the
+  lexical row: any pack-resolved lemma → `grounding_source="pack"`
+  (`chat/pack_grounding.py:461,489`) → `DECODED`
+  (`core/epistemic_state.py:133-144`). So a `speculative` and a `coherent` pack
+  lemma are **runtime-indistinguishable.** *(Adversarially upheld; no counterexample.)*
+
+### Axis B — every realized fact is `SPECULATIVE` by construction
+- Told facts: `generate/realize/realize.py:217` (`status = EpistemicStatus.SPECULATIVE`,
+  "COHERENT is never a default (ADR-0021)"). Derived facts: `realize.py:372`. Also
+  `generate/proposition.py:264`, `generate/realize/quantitative.py:108`.
+- `determine._basis` (`determine.py:88-91`) gates `verified` on those `RealizedRecord`
+  grounds — never the lexicon. So lexicon promotion can never reach it.
+
+### Axis C — three coherence-promoters exist; all are dormant at runtime
+1. **Proof-carrying (ADR-0218):** `teaching/proof_promotion.certify_promotion` +
+   `vault/store.py:417,486-507 apply_certified_promotion` (flips `COHERENT` at :507).
+   **Built, sound, independently-re-verified, fail-closed — zero runtime callers**
+   (only tests + `demos/proof_carrying_promotion`).
+2. **Energy-policy (ADR-0148):** `vault/store.py:361 promote_eligible_entries`,
+   wired into the live turn boundary (`chat/runtime.py:2324,2509`) but
+   **default-off** (`config.vault_promotion_enabled = False`). Promotes on energy
+   cooling, not coherence/entailment.
+3. **Curator review:** `teaching/review.py:274` runs live on correction turns but its
+   `epistemic_status` is a passed-in param defaulting `SPECULATIVE`; the live call
+   sets no status. Computes no coherence.
+- So `verified` is genuinely unreachable at runtime — **by deliberate conservatism,
+  not a bug.** `pipeline.py:379`'s `COHERENT` proposal branch is dead relative to the
+  live path.
+
+### Axis D — the learning loop is blind to `epistemic_status` (decisive)
+- `generate/realize/recall.py:19-62 recall_realized` **ignores `epistemic_status`
+  entirely.** `SPECULATIVE` consolidated facts are immediately re-readable as
+  premises, so deductive closure **climbs to fixed point with the speculative
+  ceiling fully in place.** The ceiling does **not** impede chaining or learning.
+- The `verified`/`as_told` distinction is **observational only** — it selects a
+  surface string (`render.py:31`) and gates nothing else.
+- Intentional and sound: `consolidate.py:22`, `realize.py:331-334` — "a sound
+  inference never upgrades the standing of its speculative premises." `idle_tick`
+  and contemplation are proposal-only/SPECULATIVE by construction
+  (`consolidate.py:21-22`, `runtime.py:871`).
+
+## Conclusion
+
+- **The all-speculative state is not why the model struggles.** The learning loop
+  works (monotone climb to deductive closure) regardless of it. The real learning
+  wall is elsewhere (recognizer/coverage), not epistemics.
+- **Do not promote entries to coherent "to help learning."** The lexicon variant is
+  cosmetic (no runtime consumer); the fact variant would make speculative content
+  admissible-as-evidence — a **wrong=0 hazard** (false `verified`) — for zero
+  learning benefit.
+- The **only genuine epistemic lever** is wiring the proof-carrying promotion path
+  (Axis C #1) so a deductively-proven derived fact can become coherent → the engine
+  could honestly emit `verified` for what it *proved* (vs. was told). That is a real
+  honesty/capability upgrade and it is wrong=0-safe (fail-closed, independently
+  re-verified) — but it was **deliberately left unwired**, so turning it on is a
+  ratified-decision, scoped separately in
+  `docs/handoff/proof-carrying-wiring-scope-2026-06-14.md`.
+
+## Cross-references
+ADR-0021 (epistemic status = revision position), ADR-0218 (proof-carrying
+promotion), ADR-0148 (energy-policy promotion), ADR-0206 (epistemic disclosure),
+`docs/issues/proof-carrying-coherence-promotion.md`, and the parallel honesty
+finding `docs/analysis/holonomy-resonance-proof-not-robust-2026-06-14.md`.

docs/handoff/proof-carrying-wiring-scope-2026-06-14.md

@@ -0,0 +1,108 @@
+# Scope: wiring proof-carrying coherence promotion (the decision)
+
+**Date:** 2026-06-14
+**Status:** decision scope — **no code; nothing wired without your call.**
+**Context:** the epistemic-coherence finding
+(`docs/analysis/epistemic-coherence-architecture-2026-06-14.md`) established that
+the speculative ceiling does **not** blunt learning. The *only* genuine epistemic
+lever is wiring the proof-carrying promotion path. This doc scopes that decision.
+Builds on the existing design doc `docs/issues/proof-carrying-coherence-promotion.md`
+(ADR-0218) — read it first; this adds the bootstrapping analysis and frames the call.
+
+## What the path actually is (precise)
+
+`teaching/proof_promotion.certify_promotion` + `vault/store.py::apply_certified_promotion`
+promote a SPECULATIVE vault claim to **COHERENT** iff a `PromotionCertificate`
+fail-closes through **all** of:
+1. the certificate **replays/verifies** under the pinned deductive engine
+   (`DEDUCTIVE_ENGINE_PIN`) — independent re-verification, not trust;
+2. the **claim** is SPECULATIVE, `reading_certified`, and its `propositional_form`
+   matches the certificate;
+3. **every premise** is `reading_certified`, form-matched, and **already COHERENT**
+   (`vault/store.py:475-507`).
+
+It is built, sound, and proven (`tests/test_adr_0218_proof_promotion.py`,
+INV-29). **It has zero runtime callers** — only tests + the demo invoke it.
+
+## The bootstrapping reality (the load-bearing subtlety)
+
+The path is the **inductive step only**: *coherent premises + verified proof →
+coherent conclusion*. But every realized fact is born SPECULATIVE
+(`realize.py:217`), and **promotion fail-closes on any non-coherent premise.** So
+the path can lift **nothing** until a **coherent base case** exists — and nothing
+in the runtime mints one. In the tests the coherent premises are hand-injected
+(`_coherent_premises` stores entries directly as `COHERENT`).
+
+Therefore wiring is **two halves**, and half (a) is the real decision:
+- **(a) A curator-certified coherent base.** A small, deliberate set of base
+  facts/readings a curator declares COHERENT (axioms / ground readings). The
+  design doc is explicit that the base + reading-certification **stay
+  curator-mediated initially** — "entailment automated, reading human, the honest
+  first cut" (proof-carrying-coherence-promotion.md:214-216). Without this, half
+  (b) is inert.
+- **(b) The runtime trigger.** Call `certify_promotion` → `apply_certified_promotion`
+  when the determine/derive path produces a SPECULATIVE propositional claim that is
+  deductively entailed by coherent premises in the vault. Narrow surface: it only
+  fires for **certified propositional forms** (the deductive-logic flagship), not
+  arbitrary cognition facts.
+
+## What wiring buys (honest framing)
+
+**This is an honesty/disclosure upgrade, not a learning fix.** Per the finding,
+learning already works at the speculative ceiling. What changes:
+- `determine._basis` could return `"verified"` (vs `"as_told"`) for a deductively
+  **proven** propositional conclusion — the engine would honestly distinguish
+  *"I proved this"* from *"I was told this"* (`render.py:31`).
+- The COHERENT-gated recall probe (`chat/runtime.py:195`, `min_status=COHERENT`)
+  would have content to return.
+
+Scope of `"verified"` stays **narrow and defensible**: only propositional-entailment
+conclusions from curator-certified coherent premises. That is exactly the verified
+flagship (sound+complete propositional logic) — surfacing it honestly is
+pitch-relevant ("watch it refuse to say *verified* unless it actually proved it").
+
+## wrong=0 analysis
+
+The promotion path itself **cannot false-promote**: it fail-closes on a failed
+replay, a non-SPECULATIVE claim, an uncertified reading, a form mismatch, or any
+non-coherent premise — and it never *vacuously* entails (refuses inconsistent
+premise sets; `test_inconsistent_coherent_premises_refuse_never_vacuously_entail`).
+**The entire risk shifts to half (a):** the soundness of `"verified"` reduces to
+the soundness of the **curator-certified coherent base**. Garbage in the base →
+sound proofs over garbage → false `"verified"`. So the base set must be small,
+auditable, and genuinely curator-reviewed. The runtime trigger adds no risk the
+fail-closed gate doesn't already cover.
+
+## Work required (if you decide to wire)
+
+1. **Base set (curated, reviewed):** a small certified-coherent axiom/reading set
+   in the vault/seed — the deliberate ground for entailment. This is the real
+   review work; keep it minimal.
+2. **Runtime trigger (small):** invoke `certify_promotion`/`apply_certified_promotion`
+   from the determine/derive path for certified propositional claims; fold the
+   promotion digest into the turn `trace_hash` (the code notes this is the missing
+   D4 step). Default-off flag first (mirror `vault_promotion_enabled`).
+3. **Disclosure + tests:** `verified` now reachable → update `docs/runtime_contracts.md`,
+   a non-vacuous test that a proof-backed claim becomes `verified` AND a
+   non-proof-backed one stays `as_told`, and confirm no path emits `verified`
+   without a replayed certificate.
+
+## The decision (yours)
+
+Three honest options:
+1. **Wire it (narrow, deliberate):** stand up a minimal curator-certified base +
+   the runtime trigger, default-off → on after review. Buys: honest `"verified"`
+   for proven propositional conclusions. Cost: the base-curation + a ratified-ADR
+   commitment to runtime coherence promotion. **My lean if you value the honesty
+   capability for the pitch** — it's the one real, wrong=0-safe epistemic upgrade.
+2. **Record "curator-mediated by design" (cheapest honest):** the design doc's own
+   fallback (proof-carrying-coherence-promotion.md:232-234) — decide the logical arm
+   isn't worth wiring now, amend the paper §3.4 to stop forward-referencing it, and
+   leave promotion curator-mediated. Zero risk, zero capability gain.
+3. **Defer:** keep it designed-but-unwired (status quo), revisit when a concrete
+   use case (a demo, a pitch beat) needs runtime `"verified"`.
+
+Recommendation: this is **not** urgent (it doesn't unblock learning), but it **is**
+the single honest "the engine earns *verified*" capability. If the pitch wants that
+beat, do (1) narrowly; otherwise (2) is the honest, cheap close. Either way, the
+current "all speculative" state is **not** a defect to rush-fix.