Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
§3.4 said promotion "requires a curator-mediated coherence judgment." That
over-states a necessity. ADR-0021 §3 only requires promotion be a function of
coherence with the reviewed field. For claims *deductively entailed* by
already-COHERENT facts, the entailment proof IS that coherence judgment and can
be machine-certified by the sound deductive_logic_v1 engine — the logical arm of
the "structural coherence metric" ADR-0021's v2 gap already names.
- position_paper.md §3.4: split "own asserted output" (no standing — kept) from
"deductively entailed from COHERENT facts" (proof = coherence judgment);
relocate review to the *reading*, not the deduction; flag the proof-carrying
path as specified-but-unwired with a link to the new issue.
- teaching/epistemic.py: the EpistemicStatus docstring claimed transitions are
"computed from coherence" — they are not; review_correction carries status as
a curator-supplied input. Docstring now states this honestly.
- docs/issues/proof-carrying-coherence-promotion.md: thorough spec for the
unbuilt capability (scope, the reading hazard, INV-21 impact, trust boundary,
falsification tests, phased plan, proposed ADR-0218).
No runtime behavior change. Green: test_epistemic_invariants,
test_epistemic_phase3_state_tagging, TestINV21OneMutationPath (15 passed).
Two pre-public-release refreshes:
1. docs/position_paper.md §4 — refresh refusal taxonomy
The previous table listed an older taxonomy (fraction_operand /
compound_comparative / etc.) that does not match the current
candidate-graph eval output. Replaced with the actual taxonomy
emitted by the train_sample runner — refusals are categorized by
shape (recognized_but_uninjectable + per-ShapeCategory) which ties
directly to the architecture's recognizer/injector concepts.
Also refreshed §5 "Honest Gaps" to describe the active frontier in
terms of injector coverage (the registry-driven composition path)
rather than parser-level grammar extensions. The 47/50 refusal
count, 3/50 correct count, and wrong=0 invariant are unchanged.
2. COMMERCIAL_LICENSE.md — enumerate subsystems explicitly
The previous "vault memory / versor engine / epistemic teaching
loop / ingest / admissibility gate / holonomy encoder" listing
predated the math-domain composition wave. Expanded the list to
cover the full current architecture:
- versor engine + Cl(4,1) algebra
- vault + exact CGA recall
- ingest gate
- admissibility gate + Forward Semantic Control
- holonomy encoder
- epistemic teaching loop (ADR-0055..0057)
- contemplation loop + decomposer (ADR-0080, ADR-0172)
- math-domain ratification handlers (ADR-0167..0169)
- composition-pattern registry + registry-driven injector
- audit-as-teaching-evidence corridor
- identity + safety pack subsystems
- language-pack compiler + verified manifest checksums
- Logos articulation + three-language vocabulary manifold
- Rust algebra backend
- any derived or successor implementation
Explicit "enumerated subsystems are illustrative, not limiting"
clause covers any future module + ADR-ratified contract under the
same terms. New subsystems are covered automatically.
LICENSE (the non-commercial form) is unchanged — it already covers
"Software" broadly. CLAIMS.md is auto-generated and was verified
current (regeneration produces no diff).
