The keel names this repository as its evidence source and cites these paths by
name in its most-read documents. They existed only in a working tree.
coreai/docs/atlas/00-atlas-overview.md "Evidence base: ... the full ADR
audit (../core/docs/adr-audit/:
all 314 ADRs, 431 findings, four
governance patterns)"
coreai/docs/plans/2026-07-29-specification-reconciliation.md
"Predecessor evidence:
../core/docs/adr-audit/ ...,
the 2026-07-28 census"
coreai/docs/Whitepaper.md "Sources: ../core/docs/adr-audit/
finding AA-250 and Pattern C-bis"
A citation to a path nobody else can reach is testimony about this repository,
not evidence from it — the keel's own transit rule, applied here. Until this
commit the atlas's entire evidence base, the specification reconciliation's
predecessor evidence, and a Whitepaper source were unreachable to every reader
but one.
docs/adr-audit/ 56 files — the ADR census, stack taxonomy, per-ADR cards,
component cards, triage log, finding register, and the
cross-batch synthesis the keel's protocol step 2b reads
docs/census/ 10 files — the 2026-07-28 module census (666 modules,
293 serving-reachable) the atlas quotes
docs/plans/2026-07-29-adr-audit-plan.md
docs/adr/INDEX-by-domain.md regenerated
evals/ two obligation fixtures updated
This is the same defect the keel spent today finding in its own records, in the
other direction: there, a pin resolved against a working tree and let an
unpublished file discharge an accepted claim. Here, published prose cited
unpublished evidence. Both are the gap between what one machine can see and what
the record can prove, and both close the same way — publish, then cite.
[Verification]: uv run core test --suite smoke -q -> 786 passed (run before this
commit; docs plus two eval fixtures, no code path touched — re-run recorded on
the PR).
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qw8vDY2bpYHUQYQp5SFKEG
Implements the external auditor for ADR-0114a Obligation #6:
"depth_curve.py produces a per-bucket curve;
accuracy(N) >= accuracy(depth_1) * (1 - eps)^(N - 1) for eps = 0.05."
Mirrors PR #189's auditor pattern (re-runs lane via the candidate-
graph pipeline, aggregates over committed cases, emits deterministic
report). Uses len(trace.steps) as the authoritative depth — the
engine's actually-executed reasoning, not the case's declared depth.
New module core/capability/depth_curve.py:
- Bucket schema mirrors ADR-0119.6: depth_1, depth_2-3,
depth_4-5, depth_6-8. Depth > 8 raises rather than silently
extending. Depth == 0 (initial-only problems) skipped — nothing
to decay.
- representative_depth = min(bucket) — most permissive bound
convention; tightening requires an ADR amendment.
- epsilon = 0.05 pinned per ADR-0120 §Threshold rationale.
- Two-axis verdict: obligation_6_mechanism_wired (always true if
auditor ran), obligation_6_assertion_holds (every populated
bucket satisfies the decay bound), coverage_sufficient (>=2
buckets populated AND >=3 cases each — required for the
assertion to be statistically meaningful).
CLI: core capability depth-curve (added to core/cli.py).
Writes evals/obligation_6_depth_curve/<lane_id>.json.
Empirical verdict on current main:
lane: B3_bounded_grammar
cases_total: 50
cases_solved: 22
mechanism_wired: True
assertion_holds: True
coverage_sufficient: False
populated: [depth_1 (21/21=1.0000), depth_2-3 (1/1=1.0000)]
Both populated buckets satisfy the decay bound. Coverage gap is
honestly named in the refusal_reason: depth_2-3 has only 1 case,
depth_4-5 and depth_6-8 have none. This is B3-owner work (case
authoring under the existing grammar contract), not auditor work;
reserved as a B3 v1.1 follow-up PR.
Honest scope-limit: B3 only. B1 (algebra, no trace) and B2 (chain
validation, not problem-solving) need different metrics — separate
sub-ADRs.
Trust boundary: read-only access to B3 cases + transitive pack
reads via the pipeline; single deterministic write to artifact path.
Tests: 24/24 covering bucket schema closure (depth 1..8 + raise on
9+), decay bound math (epsilon pinned, formula correct, depth_1 has
no bound), coverage-sufficient policy (thresholds pinned), lane
evaluation (passes on real B3 + refuses on missing cases),
coverage-sufficient distinction (B3 today vs synthetic 5+5 fixture
showing both pass), determinism (report identical + artifact
byte-equal).
Shay