- Ratified first (docs/analysis/close-flywheel-proposal-review-visibility-ratification-2026-06-16.md) before any impl edits.
- Additive proposal_review_posture in evals/close_derived_climb (from already-captured emission bodies; asserts born proposal_only/SPECULATIVE/requires_review posture, review_eligible, none_accepted_or_promoted inside the yardstick).
- Additive proposal_review_summary in evals/anti_regression DemoReport + run_demo (teaching gate review_states + ProposalLog transition counts from the temp log events exercised by S1-S3; close_derived subsection from the embedded climb).
- Updated RESULT text, contract test docstring + soft presence assert, climb __init__/contract, testing-lanes (new subsection), anti-regression docs, runtime_contracts.
- All strictly within scope: measurement/visibility only; no changes to review logic, FrameVerdict, promotion, teaching mutation, or core behavior.
- Verified: 90 contract tests green, core demo anti-regression JSON + text show the signals, climb posture present with correct values, wrong_total=0, all_gates_held + corpus_identical preserved, smoke lanes unaffected.
- Builds on #793 dedicated surface + #792/#791 embedding. Third Door / Mechanical Sympathy / Semantic Rigor alignment per ratif.
- No brief adjustments needed; workflow, scope, and success criteria followed exactly.
- Makefile: new 'test-close-flywheel' target (clearly named heavy surface; runs full Claim-B yardstick + anti embedding; explicitly not in fast/slow/full).
- docs/testing-lanes.md: new prominent 'Dedicated CLOSE Flywheel Regression Surface (Claim-B Level)' section with purpose, invocation (make primary), full Claim-B capabilities list, runtime (~60s+ heavy), hermeticity guarantees, Engineering Pillars alignment (Mechanical Sympathy / Semantic Rigor / Third Door per Whitepaper), and all cross-refs (ratifs, contract, anti demo, etc.).
- Cleanly embed / polish (additive, hermetic, building on #792): anti_regression/run_demo.py (comments + RESULT label the surface + make target), test_anti_regression_demo.py (updated docstring), docs/evals/anti_regression_demo.md (how-to + complementary section updated for surface participation).
- Supporting: contract.md (dedicated surface note + ratif links), runtime_contracts.md (tightened ref).
Ratified first (docs/analysis/close-flywheel-dedicated-regression-surface-ratification-2026-06-16.md). Strictly in scope. Preserves all invariants (wrong_total=0, determinism, proposal-only, etc.). No core, no CLI additions, no fast/CI inclusion, no teaching logic changes.
See ratification for pillars justification and 'why only correct path'.
- Semantic: determine() asserts (rule=direct) on positives post-FP in climbs
- Lived flag: _proposal_flag_effect now uses real idle_tick + IdleTickResult.derived_close_proposals_emitted (temp sink isolation)
- Checksum: added content_replay_checksum (canonical closures + proposal bodies)
- Docs: contract.md + module docstrings updated for accuracy
Ratification artifact created before impl (see docs/analysis/...-ratification-...md).
All original metrics, wrong_total=0, invariants preserved.
Closes the 3 gaps from post-merge audit for Claim B.
* test(proposals): cover derived CLOSE proposal bridge
- Flag-off and emission for member/subset + relational transitive derived facts.
- Stable dedupe, skips for non-derived/malformed/unsupported.
- No status upgrade, no corpus side-effects.
- Runtime flag wiring smoke (consolidate + bridge on → emits after idle_tick).
- Re-runs of PR-1 tests + invariants stay green.
* feat(proposals): emit review-gated proposals from derived CLOSE facts
- New focused emitter generate/determine/derived_close_proposals.py:
- collect eligible derived (member/subset + TRANSITIVE) with entailed Derivation + SPECULATIVE.
- deterministic sort + stable dedupe key (predicate+args+derivation+structure_key).
- write proposal-only artifacts (source=derived_close_fact) to dedicated sink.
- best-effort, counts returned, safe skips.
- RuntimeConfig: review_derived_close_proposals (default False), documented.
- ChatRuntime.idle_tick: after consolidation (when flag on), call emitter best-effort (no did_work, no engine checkpoint).
- IdleTickResult: new field derived_close_proposals_emitted (additive, documented).
- No change to existing proposal_review contract or comprehension-failure sink.
- No serving/determine side-effects.
* docs(proposals): document derived CLOSE proposal bridge
- docs/runtime_contracts.md: new subsection under idle passes describing eligibility,
contract (proposal-only, review-gated, default-off, no corpus/COHERENT/serving change),
and cross-ref to the analysis note.
- New dated analysis note with why (flywheel bridge after PR-1), architecture/boundaries,
artifact schema, dedupe, tests, non-goals, and composition with PR-1/PR-3.
- Tiny high-level pointer not added (no suitable learning-loop section in README at this granularity).
* fix(proposals): harden derived CLOSE proposal emission
* test(determine): cover relational transitive CLOSE consolidation
- extend with rel_pack + _tell_rel/_ask_rel/_rel_facts helpers using comprehend_relational for strict-order facts
- positives: less_than(a,b)+less_than(b,c) -> consolidate less_than(a,c); before_event same; greater/after covered
- derived record shape: .derived=True, epistemic_status="speculative", derivation.rule="transitive", .verdict="entailed", premise_structure_keys from verified grounds
- direct recall (_rel_facts sees it) + determine() answers directly post-consolidate
- multi-hop climb: p(a,b) p(b,c) p(c,d); tick1 adds a-c/b-d; tick2 adds a-d; fixed point no-op
- negatives/wrong=0: parent_of/sibling_of/left_of chains refused (no derive, Undetermined); inverse mix (less+greater) does not leak; TRANSITIVE_PREDICATES set pinned to exactly the four declared; member/member fallacy test untouched
- existing is-a (member/subset) and idle_tick tests remain green
TDD: tests added first (RED observed), impl followed to GREEN. Targeted consolidation/relational/invariants pass.
* feat(determine): consolidate declared relational transitive derived facts
- import TRANSITIVE_PREDICATES and _relational_transitive (narrow reuse of Phase C verifier)
- add _relational_transitive_one_hop_candidates(ctx): for p in TRANSITIVE only, direct 2-hops p(a,c) from realized p(a,b)+p(b,c), no reflexive (a==c), dedup vs existing, same-pred only (no inverse/symmetric/cross-predicate), deterministic sort
- consolidate_once: recall member/subset as before + rel_cands via new helper; unify + global (predicate,subject,object) sort for determinism independent of recall
- processing loop: if predicate in TRANSITIVE_PREDICATES: det = _relational_transitive(...) ; if not Determined continue; realize_derived(..., rule="transitive", premise_structure_keys from det.grounds) ; else: original _verify_subsumption + _RULE...
- verification mandatory before any write (candidate construction insufficient); realize_derived produces SPECULATIVE record with replayable derivation metadata
- budget: per-p _TRANSITIVE_EDGE_BUDGET enforced inside the reused verifier (safe no-write on over); is-a subset budget unchanged
- no change to member/subset paths or _one_hop sig for is-a; member∨member fallacy structurally unreachable as before
- wrong_total=0, INV-30 (open-world, no answer=False), only the four declared preds, no FrameVerdict, no corpus/ratified mutation
Extends CLOSE (Step D) to climb declared relational transitive substrate (Phase C) exactly as specified. Existing subsumption behaviour preserved.
* docs(determine): document relational CLOSE extension + capability-slice PR workflow
- Extended the canonical "Idle consolidation (Step D — CLOSE)" section in runtime_contracts.md to name the new declared relational transitive support (less_than/greater_than/before/after) while re-stating every existing contract (SPECULATIVE honesty, wrong=0 by verifier, replayable provenance, session-only, no COHERENT, no parallel path, etc.).
- Added dated analysis note docs/analysis/close-relational-transitive-pr1-2026-06-16.md: the reusable, organized record of (a) what PR-1 delivered, (b) full evidence, (c) the 3-PR sequence with wait conditions, (d) exact branch/worktree starting discipline (clean origin/main reconcile + force-fresh feat/ creation to avoid hygiene mix), (e) finishing/PR discipline (logical slices, 9-section report format), and (f) the documentation obligation when design/capability changes land.
- Tiny accurate cross-ref in root README.md near the learning-loop demo (high-level only; contract details live in runtime_contracts.md).
This satisfies the "properly update README.md's / documentation etc." rule for a design/capability extension. The note itself is the "solid organized, clean plan" for future slices.
* wip(b4): lift _basis to generate/epistemic_basis.py (behavior-preserving)
B4 PR-1 foundation checkpoint — the shared epistemic-basis helper extracted
byte-identically from determine.py so the closed-world frame_verdict evaluator
(coming) can compute standing without importing determine (ADR-0222 §8 A3).
determine.py imports it aliased; its 3 Determined sites + INV-30 unchanged.
PAUSED: rest of B4 (FrameVerdict type, evaluator, INV-31, PR-2/3/4) resumes
after the suite-speed arc.
* feat(frame-verdict): closed-world envelope + isolated evaluator + INV-31 (B4 PR-1)
The sealed, off-serving FrameVerdict type + the isolated text-frame evaluator + the
INV-31 firewall (ADR-0222). Composes proof_chain.entail (no second prover); a
closed-world False comes ONLY from an ROBDD refutation; absence is never false.
- generate/frame_verdict/{types,evaluate,__init__}: FrameVerdict / ClosedFrame /
ClosedWorldProof + PositiveRefutationKind enum. evaluate_frame_verdict(frame, query)
maps entail ENTAILED/REFUTED/UNKNOWN/REFUSED -> entailed_true/false/undetermined/
contradiction/scope_boundary; OPEN / undeclared-closure / non-TEXT -> scope_boundary.
__post_init__ admissibility: entailed_false needs a NAMED positive refutation; a
generic FALSIFIED raises. trace_hash is order-invariant + replay-stable.
- INV-31 (test_architectural_invariants.py): A1 determine.py clean+visible; A2 exact
construction allowlist (evals-inclusive, tests-excluded) + non-vacuity anchor; A3
transitive spine -/-> frame_verdict (reuses INV-27 walker) + resolve anchor; B1
determine() refuses a ClosedFrame. B2 deferred to the governance slice (no
non-vacuous surface yet; ADR §8 permits).
No serving wire. determine.py unchanged except the _basis import. No Determined(answer=False).
INV-30 green. Shapes follow the B4 operator master brief (PositiveRefutationKind enum,
closure_declared/source/provenance) — a consistent refinement of ADR-0222 §3.
Verified: 97 (full INV incl. INV-31 + FrameVerdict + OWA floor) + 20 frame_verdict + 35 determine.
* feat(frame-verdict): text closed-world (CWA) evaluation lane (B4 PR-2)
A measure-only lane over the text FrameVerdict evaluator (ADR-0222). Proves the sealed
type evaluates propositional closed frames safely — incl. a sound entailed_false —
without touching determine() or runtime serving.
- evals/frame_verdict_text_cwa/: cases.jsonl (12 cases across all 5 verdict kinds +
gating + absence safety), oracle.py (an INDEPENDENT truth-table propositional checker —
own recursive-descent parser + brute-force enumeration, disjoint from the ROBDD; imports
no engine module), score.py, README.
- tests/test_frame_verdict_text_cwa_lane.py: wrong=0; the disjoint oracle confirms every
gold (non-vacuity) AND the engine matches the oracle on every case; entailed_false is
proof-backed (ROBDD_REFUTATION); absence / OPEN / undeclared-closure are never
entailed_false; SHA-pinned fixtures.
Input contract: propositional-formula strings (no prose lowering). Capability-index
deliberately NOT touched (off-serving lane; documented). No Determined, no answer=False,
no serving wire. INV-30 / INV-31 / ProofWriter-OWA stay green.
* feat(frame-verdict): perception changed-slot falsification adapter (B4 PR-3)
Lift an ADR-0211 FalsificationRun into a FrameVerdict SAFELY (ADR-0222 §5.2). Critical
doctrine: "FALSIFIED" is not enough — only a POSITIVELY observed changed-slot contradiction
produces entailed_false (PERCEPTION_CHANGED_SLOT). Missing observation (absence), unexpected
extra (over-observation), and a whole-missing actual frame NEVER become false — they refuse
(undetermined / scope_boundary). SUPPORTED -> entailed_true (frame-conformance proven).
- generate/frame_verdict/perception_adapter.py: frame_verdict_from_perception_falsification;
the proof carries the FULL run trace_hash (binds expected+actual+verdict, ADR §5.4).
- generate/frame_verdict/_construct.py: extracted the single FrameVerdict builder; the text
evaluator + perception adapter both funnel through it, so the literal FrameVerdict(...)
lives in ONE file -> INV-31 ALLOWED_FRAME_VERDICT_SITES = {_construct.py}.
- tests: changed-slot -> entailed_false (+ empty-hash raises); missing/unexpected/whole-missing
never false; supported -> entailed_true; non-perception -> scope_boundary.
Off-serving; perception_adapter is in generate.frame_verdict, so INV-31 A3 already proves it
unreachable from the open-world spine. No determine() change, no answer=False. INV-30 / INV-31
/ ProofWriter-OWA / text-CWA lane stay green.
* feat(response-governance): default-dark FrameVerdict surface mapping (B4 PR-4)
The only lawful surface path for a closed-world verdict (ADR-0222 §7/§14). Lowers a
FrameVerdict to a served disposition through the EXISTING epistemic_disclosure tables (no
parallel object): entailed_true/false -> COMMIT at INFERRED + DisclosureClaim.NONE (a
committed "Yes"/"No"; entailed_false is an answer, NOT a contradiction/refusal/LimitationKind);
contradiction -> REPORT; undetermined -> REFUSE; scope_boundary -> EXPLAIN.
DEFAULT-DARK: a NEW module that changes no existing file — the open-world govern_response /
shape_surface STRICT path is byte-identical, and nothing in the live runtime calls it. The
TYPE is the closed-world tag: a forged dict / untagged object cannot widen serving (raises).
INV-31: A3 still green — core/response_governance/frame_verdict.py is NOT imported by the
package __init__ or the open-world spine, so frame_verdict stays unreachable from
chat/runtime/session/vault. The B2 anchor is now live (the forged-object rejection); all six
INV-31 anchors firm. The open-world render_determination cannot render a FrameVerdict;
determine() still has no answer=False.
Verified: 84 (governance + full INV incl. INV-31 A3/B2) green.
* harden(frame-verdict): fold in adversarial-review findings (B4)
A 4-skeptic adversarial read of PR-1..4 against real source surfaced one
soundness gap (major) and four defensive gaps (minor). All folded in; the
4 B4 files + full INV suite stay green (128 passed).
S1 (major) — perception negation was not frame-gated. The text evaluator
refuses OPEN / undeclared-closure frames (-> SCOPE_BOUNDARY) but the
perception adapter only gated frame_kind + the missing-frame sentinel, so a
PERCEPTION + OPEN + changed-slot residual produced entailed_false with
world_assumption=OPEN — a verdict that self-contradicts the type invariant
(OPEN => negation illegal). Fixed two ways:
* perception_adapter: gate OPEN / not-closure_declared -> SCOPE_BOUNDARY,
mirroring the text evaluator (graceful upstream refusal);
* types.__post_init__ §(0): STRUCTURAL backstop — ENTAILED_FALSE + OPEN
raises, frame-general, so NO producer (text/perception/future) can emit
an OPEN-world negation even if it forgets the gate.
S4-a — entailed_true was admissibility-asymmetric. Only entailed_false was
proof-gated at construction; a committed "Yes." leaned entirely on the
INV-31-A2 allowlist. Added a symmetric §(2) guard: entailed_true requires a
positive entailment/support proof (proof_chain.entail/ENTAILED or
sensorium.falsification/SUPPORTED), non-empty sha, and NO refutation kind —
a mutation test can now trip a forged positive.
S2 — A2 construction detector extended to flag FrameVerdict.<factory>(...)
classmethod constructions and module-qualified mod.FrameVerdict(...), so a
future alternate constructor cannot evade ALLOWED_FRAME_VERDICT_SITES. The
dataclasses.replace gap is RECORDED (a blanket replace() match would
false-positive tree-wide) for the serving-wiring PR, not faked.
S4-b/c — A3 firewall now bars core.response_governance.frame_verdict
DIRECTLY (not only via its re-import of generate.frame_verdict), plus a new
test proving the response_governance package __init__ stays default-dark
(does not re-export the adapter).
S3 — oracle grammar is a strict SUBSET of proof_chain.entail (it mis-parses
`false` as a free atom). Corrected the docstring and added a lane guard:
every DECIDED cases.jsonl formula must stay inside the subset, so a future
out-of-subset case fails loudly at SHA-add review instead of as a confusing
engine-vs-oracle red. SCOPE_BOUNDARY-gold garbage is exempt (both refuse).
S1-minor (construction-time-only admissibility) documented in __post_init__:
a future codec/deserialization path must re-construct via build_frame_verdict.
* docs(analysis): B4 FrameVerdict implementation lookback (PR-1..4 + hardening)
Mandatory multi-slice lookback (CLAUDE.md triggers 2+3). Audits all six B4
commits across the lookback template: documentation drift, test-coverage /
parity gaps, wrong=0 hazard surface, cross-slice consistency, honest LOC.
Categorized findings: solid (INV-30 untouched; entailed_false positive-only;
INV-31 firewall non-vacuous; default-dark; replay determinism) / hazards (the
5 adversarial-review findings, ALL fixed in the hardening commit) / recorded
gaps (dataclasses.replace A2 hole + construction-time-only admissibility,
both deferred with an explicit guard obligation on the serving-wiring PR) /
drift (type shapes are a consistent refinement of ADR-0222 §3; one non-gating
ADR note filed). Global red-line ledger: all green.
A handful of soak / bench / replay / proof / eval-matrix tests dominate the
suite wall-clock (~50 tests ≈ the entire 73-min serial runtime; the other ~10k
are near-instant). Classify them so developers can run a fast lane locally.
Mechanism — central registry in conftest.py beside QUARANTINE (cost is empirical
test-infra metadata, not test semantics, so it lives in one auditable place, not
as decorators across ~24 files). Marker-only: it stamps `slow`, it NEVER skips,
so `-m slow` SELECTS the slow tests.
- SLOW_FILES (10): whole-file, where a module/session fixture carries the cost
(marking one test would just shift the fixture cost to the next requester).
- SLOW_TESTS (26 nodeids): mixed files, so the file's fast predicate/unit tests
stay in the fast lane.
- pytest_collection_modifyitems stamps `slow`; marker registered in pyproject.
912 of 10,596 tests classified (801 = test_cognition_eval_register_matrix
eval-matrix; called out in docs — honest accounting).
Lanes (Makefile + docs/testing-lanes.md):
fast: pytest -m "not quarantine and not slow"
slow: pytest -m "slow and not quarantine"
full: pytest -m "not quarantine" (unchanged — what CI runs)
CI is unaffected: smoke.yml and full-pytest.yml run `-m "not quarantine"`, which
still includes the slow tests. No CI behavior change; no test logic touched (the
change cannot alter pass/fail in the full lane — it only adds a marker).
Timings (10-core, numpy): full 73min serial / 25min -n auto; fast ~26min serial
/ 9.5min -n auto (7.7x combined). The 975s test_inner_loop_phase2 outlier was
probed (expected proof-scale work, not a bug; finding in docs). Deferred to
follow-up PRs: -n auto by default (needs xdist hermeticity — fresh-env-dict
subprocess + report.json/proposals writers race under parallel workers) and a
warm-runtime fixture for the remaining 1-15s ChatRuntime tail.
Durable handoff brief for B4 PR-1, the first implementation step of the ADR-0222
closed-world boundary: the sealed FrameVerdict type + the isolated text-frame evaluator
+ the INV-31 two-part firewall, plus the behavior-preserving _basis lift.
Red line: PR-1 is NOT a closed-world serving feature — sealed type/evaluator + INV-31
firewall only. No runtime caller, no governance integration, no session/vault/chat wire,
no perception adapter, no CWA lane, no prose lowering.
Documentation/handoff ONLY — no implementation code in this PR. Source of truth: ADR-0222 (#780).
Cross-PR lookback review of the composed relational surface on merged main:
one-hop inverse/symmetric (#775) + transitive strict-order (#781) + overlaps_event
finite-verb reader (#783). Verdict: SOLID — 37 solid findings across predicate
tables / interactions / soundness / measurement / documentation; 0 hazards, 0 drift,
0 fix-before-next-phase.
Verified on merged main 0be18ebd: 128 relational/capability/OWA tests + 19 INV
firewalls (INV-30/29/21/25/27) + 99 smoke, all green. The three capabilities compose
with no cross-PR regression; every determination stays open-world True-only; the
B4/closed-world boundary (ADR-0222) is untouched and design-only (no runtime
FrameVerdict; INV-31 is a future obligation).
Cleanup (the only finding): remove an unused `pack` fixture parameter from
test_symmetric_table_matches_pack_ontology — cosmetic, the test re-loads the pack
internally and is non-vacuous.
Step-3 relational implementation complete.
Ratifies ADR-0222 as the design-only B4 artifact for FrameVerdict: a frame-general closed-world verdict type distinct from open-world Determined.
No runtime type, entry point, lane, or answer=False path is added in this PR. Implementation remains gated behind PR-1 with INV-31, the landed OWA refusal floor, and the staged plan in the ADR.
Final ratification patches included:
- positive_refutation_kind discriminator for entailed_false admissibility;
- PR-1-scoped Determined count wording;
- grounded-negative governance resolution as COMMIT-with-negative-surface at EpistemicState.INFERRED + DisclosureClaim.NONE.
Documents the systemic non-hermetic-test hazard surfaced during ADR-0220: ~340 of
469 ChatRuntime constructions across 123 test files default to the shared
engine_state/ dir, so tests read/pollute each other's checkpoints (the spurious
test_achat identity-continuity warning). Records the interim rule (new/edited
tests must pass engine_state_path=tmp_path or no_load_state) and the recommended
future fix (root conftest autouse fixture monkeypatching engine_state._DEFAULT_DIR
+ CORE_ENGINE_STATE_DIR), deferred to its own full-suite-validated PR. Docs only.
* docs(handoff): Step-3 relational-reasoning brief pack
Four parallel-safe briefs continuing the comprehend->determine arc after #775
(one-hop relational inference, breadth 10). Ordered OWA-first per the merge-safety
sequencing — harden unknown!=false before transitive/closed-world stress it:
1. ProofWriter-OWA refusal-floor lane (measure-only; standalone wrong=0 gate, NOT a
capability-index domain) — dispatch first.
2. Transitive relational chains (strict-order predicates only; reuses the proof_chain
ROBDD search-then-verify; non-transitive predicates must refuse).
3. overlaps_event finite-verb reader surface (closes#775's known coverage gap).
4. FrameVerdict / two-sided closed-world — DESIGN ONLY, gated behind brief 1 landing
and design ratification; no answer=False path, INV-30 preserved.
Each brief carries the shared acceptance gates (independent oracle, pos+neg fixtures,
capability-index movement, replay-stable, wrong=0, INV-30 green, no template spam) +
dispatch lines. B1/B2/B3 are file-disjoint and parallel-safe; B4 is gated.
* docs(handoff): tighten Step-3 brief dispatch semantics
* docs(handoff): address gemini-code-assist review on the Step-3 brief pack
- B1 (OWA): gold extended to {True, Unknown, False}; include gold-False items
(negation entailed). determine() is True-or-refuse, so asserting True on ANY
non-True gold (Unknown OR False) is the wrong=0 breach — strengthens the floor.
- B2 (transitive): inside_of + during_event are ALSO transitive (containment);
now explicitly DEFERRED from the first cut (admit only with their own confuser
fixtures), not silently omitted.
- B3 (finite-verb): added the finite-verb QUERY surface as scope — _read_relational_clause
requires questions to start with 'is', so an overlaps_event query is unparseable
today; pin one interrogative form (Does A overlap B?) and fail-closed, else the
symmetric case refuses and yields no coverage.
Removes code_revision from the engine-identity hash: engine_identity is now the
sha256 of the 5 ratified packs ONLY. The build revision is provenance (the
manifest's written_at_revision), not identity — so a behavior-neutral rebuild is
the SAME identity and the always-on daemon no longer flag-day strict-breaks on
every commit (the ADR-0220 defect).
Core:
- core/engine_identity.py: ratified_substrate/compute_engine_identity drop the
git_revision arg (packs-only); add compute_legacy_engine_identity (reproduces
the pre-split packs+rev hash, for migration verification), ENGINE_IDENTITY_SCHEME=2,
IdentityReconciliation enum, and reconcile_loaded_identity — the single source of
truth for the runtime guard AND the workbench reader.
- chat/runtime.py: the load guard reconciles via scheme. Current scheme -> direct
packs-only compare. Legacy (code_revision-folded) stamp -> a VERIFYING migration:
reconstruct the legacy hash from the persisted written_at_revision; a match proves
packs unchanged (warn + re-stamp, resume, no break) — a mismatch means the packs
genuinely changed (DIVERGED -> strict-refuse). Preserves 'distinct packs => refuse'.
- engine_state/save_manifest: stamp identity_scheme alongside engine_identity
(additive-optional; no schema_version bump).
- workbench/readers.py: continuity reader uses the same reconcile (no phantom break
on legacy checkpoints). cli.py break message reworded (packs, not 'build revision').
Callsite cleanup: drop the now-unused git_revision arg + imports across
always_on.py, evals/l10_always_on/runner.py, workbench/readers.py.
Tests:
- test_identity_provenance_split.py (new): 5 reconcile unit proofs + 3 runtime
integration proofs incl. the wrong=identity defense (legacy stamp of DIFFERENT
packs still strict-refuses) and the re-stamp migration.
- test_engine_identity.py: invert the code-revision test (rev no longer changes
identity); assert the substrate is packs-only.
- Restore 3 lineage tests silently red since ADR-0219 (flat-path _manifest helper
now resolves the gen-dir).
- Update remaining callsites/monkeypatches for the new signature.
Hygiene: .gitignore now covers the ADR-0219 gen-dir runtime files
(current, gen-*/, session_state.json, proposals.jsonl).
Verified: 59 identity/migration/lineage/workbench + 32 L10 + 76 invariants/cli +
34 smoke pass; serving lane SHAs unchanged (no derivation/reliability_gate touch).
Records why main is protected with CI status checks only — no required approvals,
no required code-owner review. Public exclusion comes from repo WRITE ACCESS, not
a review rule; a self-approval requirement on a single-identity repo only creates
an unsatisfiable deadlock that forces --admin on every merge (cf #772).
- ADR-0221: context (the deadlock), the misconception corrected, the decision,
an explicit 'do not re-add human-review gates' guard for future agents, the
applied gh-api change, and the break-glass log.
- CODEOWNERS: comment corrected to ADVISORY-ONLY (require_code_owner_reviews is
now false); keeps * @AssetOverflow for ownership/auto-request, not gating.
Applied 2026-06-15: required_approving_review_count 1->0, require_code_owner_reviews
true->false; required status checks unchanged. This PR is the first through the
fixed normal path — its clean, approval-free, no-admin merge is the proof.
Mastery-v2 Step 2 (DCS/W2 reconciliation audit). The reviewer flagged that
ADR-0170 might still read as pending while the code shipped. Audit (read source
+ provenance + measured the metric) confirms:
- DCS-S1 acquisition (W2) is INTENTIONALLY SERVING, not a boundary escape:
PR #377 (b190f3b6) landed it in serving _INJECTORS BEFORE the sealed lane
(ADR-0186 = PR #487) existed. The sealed lane (_SEALED_INJECTORS = {}) is
correctly empty, reserved for future W3-W5.
- wrong=0 held: train_sample committed 4/0/46, confirmed live on current code
(test_adr_0126_train_sample_runner 4/4 green); 6 committed cases exercise the
acquisition path (collected x4, collects, receives).
- Placement already mechanically pinned by the existing test pair —
test_adr_0170_w2 (W2 emits via serving _INJECTORS) + test_adr_0186 (sealed
lane is an empty no-op) — so NO new test is added (would be redundant).
Two stale docs, now reconciled (documentation-only; no code/logic change):
1. ADR-0170 status: "Proposed / no runtime change" -> "Accepted; W1+W2 shipped";
implementation-outline annotated with shipped/deferred status per W-stage.
2. recognizer_anchor_inject.py sealed-lane comment: "resume ADR-0170 W2-W5" ->
"W3-W5", noting W2 ships from serving _INJECTORS (PR #377), never the lane.
W1+W2/sealed-lane/train_sample lanes: 36/36 green.
Adds the one missing mechanical firewall in the learning-boundary set: the
open-world determination gear (generate/determine/determine.py) may construct
only Determined(answer=True) or refuse (Undetermined) — it can never assert
answer=False. Absence never refutes (open-world); a False from absence would be
an unsound, wrong=0-class assertion. The planned DEEPEN/Step-2b closed-world
entailed-negation capability (ProofWriter-CWA / FOLIO two-sided labels) must use
a distinct closed-world result type and entry point, so this invariant keeps it
lane-scoped by construction rather than by reviewer vigilance.
INV-30 follows the existing suite's Schema-Defined-Proof-Obligation discipline:
- test_no_determined_asserts_false — the firewall (project-wide AST scan)
- test_detector_is_non_vacuous — proves it FAILS on injected answer=False
- test_detector_ignores_true_and_reads — proves no false positives
- test_determine_construction_sites_are_visible — proves the scan is not blind
Doctrine: CLAUDE.md Teaching Safety + docs/runtime_contracts.md now state the
corrected typed-learning boundary (durable=reviewed/proof-carrying;
provisional=autonomous iff typed/isolated/replayable/non-masquerading) and cite
the enforcing invariants INV-21/22/23/24/29/30, including the honest wrinkle that
ADR-0148 promote_eligible_entries is a second, opt-in, default-off COHERENT path.
No source code changed; firewall is additive.
Full architectural invariant suite: 65/65 green.
Documents the contradiction between ADR-0157 (revision mismatch = non-fatal
warning) and engine_identity.py:99 (same revision folded into the identity hash
= hard raise under strict continuity). Proposes the identity_substrate_hash vs
build_provenance_hash split (O3), staged A/B/C, with corrected operator-recovery
guidance (never mv/rm the default engine_state dir — it is the tracked package).
No code change; proposed, awaiting ratification.
Reconcile the living docs with the shipped Vault evidence surface:
- README "Shipped surfaces": record the Vault P0 (honest empty/unavailable
framing, #760), P1 (inspector depth + status/facet/text filters +
evidence-rail progression, #762/#763/#764), and P2 (read-only exact-CGA
recall, #766) arc as complete; enrich the Vault entry row. Read-only
throughout — no runtime controls.
- wave-R: extend the Vault surface bullet with the recall endpoint and the
P0/P1/P2 completion note + the +inf-self-match-sentinel honesty point.
- api-contract-v1: add GET /vault/entries/{index}/recall (purpose, errors,
trust boundary, cross-link to the data shape).
- data-shapes-v1: add VaultRecallHit / VaultRecall types.
- UI-UX-GUIDE: enrich the Vault row (inspector depth, filters, rail, opt-in
exact-CGA recall; read-only).
Docs-only; no code or contract behavior change.
Closes the cross-file checkpoint-atomicity gap in ADR-0156. The four
checkpoint files now live in a committed gen-NNNN/ directory; the single
atomic os.replace of a 'current' pointer file is the commit boundary.
A kill before the pointer swap leaves the prior committed generation
intact; a kill after commits the new generation. Unreferenced gen dirs
are ignored. ADR-0156's deferred parent-dir fsync is also closed.
Key changes:
- engine_state/__init__.py: begin_generation() + commit_generation() +
_resolve_dir() for all load_* methods. Flat-layout legacy checkpoints
migrate into gen-0000 on first begin_generation call. GC retains K=2
committed generations.
- chat/runtime.py: checkpoint_engine_state uses the two-phase commit;
finalize_turn_trace_hash no longer writes discovery_candidates outside
the generation sequence (the second unguarded write path is closed).
- evals/l10_continuity/runner.py: _inject_orphan_tmp updated to inject
the two orphan shapes of the generation model.
- tests/test_adr_0219_generation_checkpoint.py: 18 tests, one per
acceptance-gate bullet + biting mutation variant each.
L10 lane: all_gates_pass=true; versor_condition<1e-6 throughout.
Smoke: 95 passed. Runtime: 20 passed.
* feat(l10): autonomous idle frontier-contemplation — the always-on life learns on its own
Frontier survey move #2, path (c): give the always-on idle life a stream of experience via
SYMBOLIC intake (not the afferent→field seam, which is deferred pending a commensurability
ruling — docs/analysis/afferent-field-ingest-scope-2026-06-15.md). The idle heartbeat
converges (idle_tick drains a finite backlog + saturates is-a closure, then does nothing
forever); this makes it autonomously MINE its frontier with no user turn.
Reuse-heavy (the mechanism largely existed): a gated idle pass wires ADR-0080 contemplation
into the always-on loop.
- core/config.py: contemplate_frontier_during_idle (default off → no behavior change).
- chat/runtime.py: idle_tick pass 2b — when on, runs core.contemplation.run_contemplation()
(mines the checked-in frontier-compare reports) and persists a reviewable ContemplationRun
to <engine_state>/contemplation_runs/idle_<substrate_hash>.json. IDEMPOTENT per frontier
(an already-mined frontier is not re-persisted → the life converges, no churn) and MEMOIZED
per session (the static frontier is mined once, not re-read every beat). SPECULATIVE-only
(ADR-0080: ContemplationFinding.__post_init__ RAISES if not SPECULATIVE → wrong=0 by
construction; never ratified here — the HITL path is untouched). IdleTickResult gains
frontier_findings.
- chat/always_on.py: run_continuous did_work + HeartbeatRecord count frontier work, so the
heartbeat/soak convergence (H3) stays honest.
- core/cli.py: `core always-on --contemplate-frontier` (explicit learning-daemon mode) +
honest per-beat log ("+N findings").
Adversarial 3-lens review (wrong=0/convergence, determinism/trust-boundary, test-vacuity)
found 7; fixed the real ones: the MEDIUM torn-write (write_contemplation_run is now atomic
temp+os.replace — the indefinite-uptime daemon expects SIGKILL mid-write, and the skip-guard
would never repair a torn canonical file), the gitignore breadth (contemplation_runs/ at any
engine-state root), the 64-bit filename truncation (full substrate_hash), and the
re-mine-every-beat cost (session memoization). Deferred + documented: the shared
contemplation miner embeds absolute report paths in finding CONTENT — a portability wrinkle
that does NOT affect wrong=0/convergence/soak determinism (those key on the content-only
substrate_hash) and touches shared code + its test surface; a follow-up.
Tests (non-vacuous): 7 — off-by-default (no behavior change), mines-when-enabled,
findings-SPECULATIVE (wrong=0), converges-idempotent, heartbeat-mines-then-converges,
mines-once-per-session (memoization), atomic-no-orphan. 55 idle/contemplation/always-on +
96 invariants/contemplation + 28 smoke green; `core always-on --contemplate-frontier` mines
end-to-end. engine_state contemplation_runs are per-life runtime state (gitignored).
* fix(l10): isolate idle frontier pass + persist frontier_findings (#758)
Three review blockers on the autonomous idle frontier-contemplation pass:
1. Daemon isolation. idle_tick's pass 2b called run_contemplation /
write_contemplation_run bare inside the always-on loop (run_continuous
wraps idle_tick in nothing but an exit-checkpoint finally), so a malformed
frontier report or a transient FS fault would propagate out and KILL the
continuous life. Wrap the optional pass best-effort (the exit-checkpoint
boundary idiom): degrade to 0 findings + RuntimeWarning, leave did_work
untouched, let a later beat retry.
2. Durable did_work explanation. HeartbeatRecord carried frontier_findings
but serialize_report omitted it and AlwaysOnReport had no run total, so
lived_life.json could show did_work=true with facts=0/proposals=0 and no
persisted cause. Persist frontier_findings per-record + total_frontier_findings.
3. Honest HITL claim. The docstring/CLI/config said findings are "reviewable
via the HITL path", but the existing HITL queue + workbench reader scan
<repo>/contemplation/runs while the pass writes <engine_state>/contemplation_runs/.
Narrow the claim to "persisted reviewable artifact, not yet in the HITL
queue" (wiring that discovery is a follow-up).
Tests: 4 new non-vacuous regressions (mining-failure degrade, write-failure
degrade, always-on loop survives frontier failure, lived_life persists
frontier_findings) — all fail against the unpatched pass. 38 L10/always-on/
workbench tests green.
The wave-* planning docs record their wave, not current state. Add a
consistent "Historical record — superseded" banner to each, pointing to
README (Current Status), UI-UX-GUIDE, and the route registry as the live
sources. wave-1/R/M-worthiness/M-consolidation covered.
Docs only.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Bring the four living workbench docs up to date with what actually
shipped, and document the TruncatedCell full-content reveal.
- README: route count 14 -> 16; add Lived Life (Evidence) and CORE-Logos
(Substrate) to the shipped-surfaces table; full Trace tab list; add the
TruncatedCell reveal to cross-cutting; link the visual-evidence handoff;
bump status date.
- UI-UX-GUIDE: §12 now reflects the built read-only /logos reader vs the
unbuilt Studio; §13 moves the cognitive-pipeline visualizer, field/
versor_condition reader, and identity-continuity items from "absent" to
"shipped"; new §14 documents the truncated-cell reveal pattern + the
<a>/<Link> non-nesting boundary; bump date.
- ui-component-map: add TruncatedCell to shared data viewers.
- design-system: add the Truncated Cell Reveal shared-component note.
Docs only; no code change.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Add a handoff brief with five screenshots captured by driving the real
vite-preview build with Playwright (mocked API), confirming the
full-content reveal works across the originally reported proposal queue
table, the trace propagation edges, and the trace selection rails — with
the row staying unselected on reveal (stopPropagation holds).
Verification only; no code change. Records the harness gotcha that a
role-by-name query resolves to the row, not the icon trigger.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
The L10 heartbeat loop (run_continuous) had no process to drive it; `core always-on`
is that process — the T-experience spine made runnable. It ticks idle_tick on a wall-clock
cadence so the engine LIVES and LEARNS with no user turn, persists lived_life.json (the
workbench Lived Life surface) + the checkpoint, and resumes the SAME life on restart.
- chat/always_on.py: run_continuous gains unbounded operation (heartbeats=None, runs until
stop) + an interruptible inter-beat wait (_sleep_until_stop) so shutdown latency is one
slice, not the cadence interval. Persists the run's identity pack ids (resume-verdict
faithfulness). on_heartbeat is now best-effort (a broken log pipe can't kill the life).
- chat/always_on_daemon.py (new): the daemon shell — a single-instance OS lock (fcntl.flock:
kernel-held, atomic, auto-released on death — no stale window, no PID-reuse, no half-written
race), SIGINT/SIGTERM -> graceful stop (handlers saved/restored), the continuous-life config
FORCED on, ephemeral (--no-load-state) writes no durable artifact. Foreground + explicit:
no hidden background execution (CLAUDE.md); only writes the engine-state dir it was given.
- core/cli.py: `core always-on [--interval --max-beats --no-load-state --quiet]` with per-beat
+ summary logging; validates --interval; reports IdentityContinuityError / IncompatibleEngine
StateError (the "different life / newer build" cases) as clean refusals, not tracebacks.
- workbench/readers.py: ENGINE_STATE_ROOT now honors CORE_ENGINE_STATE_DIR (= the daemon's
resolved dir), so the workbench can't be split-brained (reading REPO_ROOT/engine_state while
the daemon writes elsewhere); the Lived Life resume verdict recomputes from the persisted
pack config, not a default config (no false substrate_changed for a non-default-pack life).
- Lived Life absence state now points at the real `core always-on` command (loop closed).
Adversarial 4-lens review (lock/concurrency, signals/shutdown, invariants/trust-boundary,
test-vacuity/CLI) caught 16 findings; this fixes all real ones — the HIGH lock races (two
daemons over one life), the env split-brain, the IO-kill, the uncaught identity/schema errors,
the unvalidated interval, the ephemeral-artifact shadow, and the resume-verdict pack-id bug —
and closes the two test-coverage gaps it flagged (real SIGTERM path + config-forcing-at-the-
runtime boundary).
Tests (non-vacuous): 11 daemon (flock live-holder refusal, leftover-lock reclaim, unbounded+
stop, interruptible sleep, forced-config-at-boundary, no-load-state guard, REAL SIGTERM
subprocess) + the reader pack-id discrimination test (fails under the old default-config bug).
245 workbench+invariants+always-on Python green; frontend tsc + vitest green; `core always-on`
verified end-to-end (bounded, real SIGTERM graceful stop, interval rejection).
engine_state/always_on.lock is runtime state (gitignored, ADR-0146 pattern).
The L10 heartbeat (chat/always_on, #747) holds CORE alive over uptime but had no
surface. This adds the read-only Lived Life route that renders the continuous-life
evidence: the heartbeat over uptime + the resume-as-same-life verdict — both halves
of "one continuous life" on one surface.
Persist-first, never recompute engine-owned values:
- chat/always_on: serialize_report + write_lived_life persist a run deterministically
(sorted keys) to engine_state/lived_life.json; run_continuous gains an opt-in
report_path so a real continuous-life run leaves its evidence where the workbench
reads it. closure_ceiling is persisted so the artifact is self-describing.
- workbench/lived_life.py: projection + a fail-closed validate() gate — the wrong=0
analogue for the continuity surface: closure_held/closure_observed/totals/converged
are each re-checked against the per-beat measurements, and resume_status is re-checked
against identity-vs-current-substrate, so a tampered artifact RAISES rather than
rendering a false claim (a beat lying about a breached ceiling, an inflated closure,
a miscounted total, a falsely-claimed resume).
- workbench/readers.lived_life(): reads the artifact, computes the resume verdict from
the persisted identity vs the canonical engine_identity_for_config (fail-soft ->
"unknown", like IdentityContinuity). Honest absence when no run has been persisted.
- GET /lived-life + LivedLife/LivedLifeHeartbeat schemas (snapshot regenerated; the
schema-drift gate proves every field is mirrored in src/types/api.ts).
The resume verdict made felt: would_resume / substrate_changed / unknown IS the L11
reboot guarantee (a reboot recomputes identity and refuses if it differs) — so the
surface shows this life wakes up as ITSELF, not a copy. The per-reboot lineage chain
stays owned by Runs > Identity (honest cross-link).
Frontend: /lived-life route (Evidence section, route count 15 -> 16). Renders the
headline (heartbeats, closure-held-by-construction, learned-while-idle, at-rest, resume
pill), the summary, the heartbeat timeline (closure flat below the ceiling — read, never
repaired), and the resume verdict. Honest absence + ADR-0162 route conformance
(loading/error/empty), fail-closed like Vault/Calibration.
Tests (non-vacuous): 12 backend (every tamper case raises; resume tracks identity vs
substrate; run_continuous(report_path) round-trips a readable+valid artifact) + 4
frontend render tests (recorded life renders; a breached beat shows the warning, never a
false "held"; a changed substrate shows would-refuse, never a false resume; absent shows
honest absence). All workbench Python (167) + affected vitest (167) + tsc + vite build
green; architectural invariants green.
engine_state/lived_life.json is runtime state (gitignored, ADR-0146 pattern).
Evidence-based map of the comprehension coverage wall (the C decision). GSM8K
diagnostic: 4/0/46, no single barrier >10%, ~24 fragmented primary barriers with
heavy multi-barrier co-occurrence (compound+comparative+fraction+coreference stack
on the same cases). Capability lanes are narrow curated-gold conformance
(combined-rate: 6 solvable shapes, 19/19 oracle). Single-shape recognizers are
proven metric-inert (4th confirmation). Diagnosis: shape-recognizers don't COMPOSE
within compound statements / across coreference. Leverage: Tier 1 recognizer
additions ~+5 cases then cap; Tier 2 compositional reading is the only real lever
(architectural, must stay wrong=0). Recommendation: don't add isolated recognizers;
design a compositional reader.
The only genuine epistemic lever (per the finding). Scopes the ADR-0218 path: it
is the inductive step (coherent premises + verified proof -> coherent conclusion),
fail-closed and sound, but needs a curator-certified COHERENT base that nothing
mints today (bootstrapping). Wiring buys an honesty/disclosure upgrade (verified
for proven propositional conclusions), NOT a learning fix. wrong=0 risk shifts
entirely to the curator-certified base. Three options framed (wire narrowly /
record curator-mediated-by-design / defer) with recommendation.
7-agent architecture audit + adversarial verification refutes the intuition that
all-speculative packs cap the model's learning. The reasoning/learning loop is
blind to epistemic_status (recall_realized ignores it; speculative facts chain to
deductive-closure fixed point). Lexicon-status promotion is compile-and-display-only
(runtime epistemic state comes from grounding_source, not the lexical row). The
verified/as_told distinction is honesty-disclosure-only and intentional. All three
coherence-promoters are dormant (proof-carrying demo-only, energy-policy default-off,
review never sets coherent). Conclusion: do NOT promote-to-coherent for learning
(cosmetic at best, false-verified wrong=0 hazard for facts); the only genuine lever
is wiring the sound, fail-closed proof-carrying path — a separate deliberate decision.
Measuring the holonomy tri-language resonance (intended for a Studio proof-card)
showed it is NOT a robust proof: the engine's own holonomy_similarity (CGA inner
product) anti-correlates, and the Euclidean 'aligned closer than misaligned'
claim passes only via averaging in the close Hebrew distance + one cherry-picked
negative (1.3% margin) — the aligned Greek clause is itself farther than the
negative, and the verdict flips ±20-55% under other negatives. Decoration, not
proof (CLAUDE.md, Schema-Defined Proof Obligations).
- docs/analysis/holonomy-resonance-proof-not-robust-2026-06-14.md: the rigorous
finding (numbers), why a Holonomy proof tab cannot be built honestly yet
(stays missing_evidence), and bounded research questions.
- Downgrade the two clause-resonance decoration tests to honest tripwires that
assert the true state and fail (pointing to the doc) if the resonance becomes
real. Token-pair cga_inner tests left intact + flagged as a separate, un-audited
claim.
70 holonomy-adjacent tests pass.
- New docs/workbench/EVALUATOR.md: a falsifiable 10-minute guided path for an
external technical evaluator (tour -> replay hash -> wrong=0 ledger ->
calibration arena -> logos geometry), an honest-scope section (verified
flagship = propositional entailment; GSM8K diagnostic; field = coherence-gate
not reasoner; holonomy = roadmap), and a 'verify, don't trust' section. Every
reference points at a real file/surface (checked).
- README: 'fourteen' -> 'fifteen' routes + add CORE-Logos (LG-2/3/4 drift fix);
point new evaluators at EVALUATOR.md.
The workbench READMEs were frozen in the W-026..W-031 planning era. Bring them
current after the Wave 1 / R / M arc:
- docs/workbench/README.md (index): add the 5 unindexed docs (wave-1-evidence-
spine, wave-R-mastery-revamp, wave-M-worthiness, b4-leeway-producer-scope,
design-system); replace the false "Current Status" (which still pointed at the
superseded feat/w026 prototype) with the shipped state + a 14-route surface
table; mark the W-026..W-031 queue delivered; note Wave M complete (B+C+D+B4),
Phase E + parallel tracks remaining.
- workbench-ui/README.md: fix the stale one-line surface list and the "src/routes
placeholder components" description (routes are registry-driven in src/app/;
routes.ts is the single source). Left the dump-api-schemas.py reference intact
(it exists, distinct from dump-schemas.py).
- README.md (top level): the workbench section said "eleven routes" — now
fourteen, naming Tour, Contemplation, and Calibration and the per-turn
pipeline/field/leeway/bundle evidence.
Docs-only; no code or gate touched. UI-UX-GUIDE (the routes.docs.test-gated
route table) is unchanged and already at 14.
Clears the long-standing B4 block: the leeway decision was already made on the
serving path (chat/runtime.py::_surface_estimate has a real LicenseDecision +
the ReachPolicy) and then DISCARDED — never threaded to the result, and the
workbench can't import reliability_gate. This wires it through.
Producer (observational, never authorizing):
- core/cognition/leeway.py: LeewayRecord + build_leeway_record(reach_level,
license_decision) — duck-typed on the decision, zero new cross-package
coupling. Maps to: no decision -> "unknown" (STRICT, no latitude); denied
-> "blocked" (gate consulted, said no); licensed SERVE/PROPOSE widening ->
the real class / theta / "[approximate]" disclosure. "verified" is never
emitted (RESERVED state). source_digest content-addresses the decision
(deterministic, no wall-clock).
- core/cognition/result.py: additive `leeway: LeewayRecord | None = None` on
CognitiveTurnResult.
- core/cognition/pipeline.py: build it at result construction from the data
the runtime ALREADY exposes (response.reach_level +
runtime.last_turn_accrual().license). chat/runtime.py is UNTOUCHED.
- workbench/api.py: _leeway_evidence_from_result maps result.leeway ->
LeewayEvidence (pure projection; no reliability_gate import — firewall
intact). The journal already persists it; the B4a UI (Replay / Proposals /
RightInspector) already renders it — no frontend or schema change needed.
Safety (this touches the serving path, so proven, not asserted):
- trace_hash is a NAMED-field hash (core/cognition/trace.py); `leeway` is not
in it -> byte-identical serving. All provenance/trace tests pass.
- response_governance STRICT stays byte-identical (375 governance/serving/
provenance tests green, incl. the live-wiring + estimation-lane + ADR-0206
seam tests).
- core eval cognition: 13 cases, 100% intent / groundedness / versor closure.
- replay determinism holds (leeway is in CRITICAL_FIELDS; deterministic).
Tests: engine (build_leeway_record: strict/blocked/SERVE/PROPOSE, no "verified",
deterministic digest) + workbench mapping (field-for-field, honest absence,
invalid-enum clamp) + integration (a real turn now carries an honest leeway
record, not the null "No evidence recorded"). 151 workbench/leeway Python + 68
frontend (leeway/replay/proposals/schemaDrift) green; schema-snapshot unchanged.
Docs: gate cleared (b4-leeway-feasibility-gate.md), residue ledger flipped to
implemented, scope brief is b4-leeway-producer-scope-2026-06-13.md.
The leeway decision already exists at chat/runtime.py::_surface_estimate
(accrual.license is a real LicenseDecision) but is discarded — never threaded to
CognitiveTurnResult, and the workbench can't import reliability_gate. Brief lays
out: the exact producer seam, the LicenseDecision/ReachPolicy -> LeewayEvidence
mapping, two honest layers (STRICT-now / earned-APPROXIMATE), the firewall-safe
workbench mapping, constraints, a minimal additive Layer-1 first PR, and 4 open
questions.
The "they'd want to use it" first-run surface: a curated narrative that makes
the engine's discipline legible to a newcomer — bring a claim from any model and
watch it get decided, refused, or replayed. Proposer authority ignored.
Honest by construction (the risk with a narrative surface is theater):
- workbench/tour.py determinism_tour() is a curated ordered narrative BOUND to
the real demo registry. Intro (provider-agnostic thesis) → three demo steps
(deductive entailment decides only on engine+oracle agreement; epistemic
truth-state refuses a wrong proposer; proof-carrying promotion ignores
proposer authority) → payoff (replay-to-same-hash + the citable evidence
bundle).
- Each demo step's what_this_proves / what_this_does_not_prove cards and the
demo title are PULLED FROM THE REAL DEMO SPEC — never re-authored — so the
tour can never claim more than the demo it points at.
- A step referencing a missing demo FAILS CLOSED (KeyError), not a dead link.
Tests assert both (cards == spec; phantom demo raises).
Backend: schemas.py DeterminismTour/TourStep; GET /tour. schema-snapshot regen.
Frontend: /tour route registered in the registry (Determinism section, 14
routes; nav/palette/guide counts updated); TourRoute — thesis hero + ordered
step cards with the honesty cards + links to the real demos / replay.
Validation: 140 workbench Python tests incl. tour drift guards; 472/472 frontend
incl. routes/routeConformance/routes.docs (guide↔registry), Shell+palette counts
(14), schemaDrift, and the tour UI test; pnpm build clean; git diff --check
clean. No serving-path imports.
The "they'd want to use it" deliverable: a turn's evidence exported as ONE
deterministic, content-addressed, citable artifact — composing the Phase-C
evidence (pipeline + field) with the trace and the calibration leeway verdict.
Backend (read-only, no engine execution):
- schemas.py: EvidenceBundle.
- workbench/evidence_bundle.py: build_evidence_bundle(entry) assembles a turn
journal entry into the bundle and computes bundle_digest. The digest
content-addresses the DETERMINISTIC cognitive evidence only — journal
position + wall-clock (turn_id, journal_digest, replay_reproducer,
generated_from) are carried for provenance but EXCLUDED, so the same turn
content reproduces the same digest regardless of journal position.
- api.py: GET /trace/{turn_id}/bundle. schema-snapshot.json regenerated.
The bundle carries a replay *reproducer* command (how to verify) rather than a
live-run replay, so the artifact itself stays deterministic — verification is
the consumer's step: re-run the prompt sealed, confirm trace_hash, recompute the
bundle, check the digest.
Frontend:
- types/api.ts EvidenceBundle; client/query hook; Trace route **Bundle** tab —
citable digest, "what this proves / does not prove" honesty note, the
reproducer, and a deterministic JSON download (Blob anchor, leak-safe).
Validation: 135 workbench Python tests incl. non-vacuous bundle guards (digest
reproducible, journal-position/wall-clock excluded, any evidence change flips
the digest, missing Phase-C evidence honest); 468/468 frontend incl. schemaDrift
+ the citable-download bundle test; pnpm build clean; git diff --check clean. No
serving-path imports.
C2-a surfaced contemplation runs but rendered each scene as a flat JSON dump —
outputs, not process. C2-b makes the loop legible: every scene is now a typed
stage in the canonical ADR-0172 arc.
Reader-first (no theater):
- schemas.py: ContemplationScene gains a typed loop projection — stage_role
(cold_attempt | engine_enrichment | engine_proposal | operator_ratifies |
grounded | other) plus the connective ids (proposal_id, candidate_id,
proposal_state, grounding_source). New ContemplationStageRole Literal.
- readers.py: _contemplation_scenes derives stage_role from the scene id
(closed set, "other" fallback) and pulls the connective ids out of the raw
detail. schema-snapshot.json regenerated.
UI:
- ContemplationRoute: the run detail now renders the arc as a staged process —
"attempt → enrich → propose → ratify → grounded" with named stage roles,
cold→grounded bookends (surfaces pulled out of before/after), the connective
ids as evidence, and the raw detail tucked into a collapsible (not lost).
Honest wrinkle (surfaced, not faked): the fixture proposals do NOT resolve in
the live proposal log (source_kinds exemplar_corpus/operator, none
contemplation), so the proposal id is shown as evidence but is intentionally
NOT a clickable cross-route link — a dead link would be theater. Live
Proposals/Calibration navigation is deferred to reader-verified linking once
real contemplation proposals reach the log.
Validation: 128 workbench Python tests + new reader-projection tests (canonical
arc → roles, unknown → "other", id extraction, detail preserved); 466/466
frontend incl. schemaDrift + the staged-process / no-dead-link test; pnpm build
clean; git diff --check clean. No serving-path imports.
Makes the CL(4,1) field geometry legible, honestly. The engine owns the field;
this surfaces ONLY the exact scalar invariants it computes — never the raw
multivector — so the workbench shows "this is the geometry, it's exact, it
can't fake coherence" without a decorative blob or any motion.
Persist-first (the C3 gating work was Python, not React): the honest scalars
were computed live per turn but discarded. Now captured per turn into the
journal so a read-only surface has real evidence.
Backend:
- workbench/field_evidence.py: FieldEvidence computed from the engine result —
exact versor_condition, field_valid (vs the 1e-6 ceiling), a content-
addressed field_digest (sha256 of the engine-canonical array bytes), and
cga_inner(before, after) as the exact transition value. Raw field bytes
never cross the boundary: only floats + digests. validate() is fail-closed —
field_valid can never disagree with versor_condition vs the ceiling (the
wrong=0 analogue for the geometry). No engine math re-implemented
(versor_condition / cga_inner imported from algebra; bytes via array_codec).
- workbench/schemas.py: FieldEvidence dataclass; field_evidence on
ChatTurnResult + TurnJournalEntrySchema. schema-snapshot.json regenerated.
- workbench/journal.py + api.py: persisted at from_chat_turn; first-class read
endpoint GET /trace/{turn_id}/field (trace facet, consistent with /pipeline).
- workbench/replay.py: field_evidence classified CRITICAL — replay now also
proves field determinism (digest + scalars must match on re-execution).
Frontend:
- types/api.ts FieldEvidence + field_evidence passthrough; client/query hook;
FieldInvariantCard (measured value vs ceiling, cga_inner transition, digests;
honest missing_evidence; no blob, no motion); Trace route Field tab.
Honest-empty for pre-widening journal rows (missing_evidence). Deferred:
cross-turn field-coherence trends, session-level field persistence.
Validation: 138 workbench/practice Python tests (incl. non-vacuous field guards
+ replay field-determinism); 465/465 frontend incl. schemaDrift; pnpm build
clean; git diff --check clean. No generate.derivation / reliability_gate /
stream / field.propagate / vault.store imports.
Lands the Phase C "make cognition legible" slice plus Phase A residue, all
backend-reader-first over real engine data (no theater, read-only doctrine
intact, zero serving-path imports).
C1-a — Cognitive pipeline record (persistence-first, per #729 worthiness edit):
- workbench/pipeline_record.py: curated CognitivePipelineRecord over the real
CognitiveTurnResult (input → intent → proposition_graph → articulation_target
→ realizer → walk_telemetry → trace_hash). Raw field multivectors are
DELIBERATELY excluded; _assert_no_raw_field_payload recursively rejects raw
field keys, and validate_pipeline_record fails closed on missing/duplicate
stages, non-recorded status, or dangling edges — the UI can never receive a
partial record that claims to be complete.
- test_workbench_pipeline_record.py: non-vacuous guards — missing stage,
monkeypatched new required stage, and injected raw {"F": [...]} each raise.
C2-a — Contemplation as a process: /contemplation route over real persisted
contemplation/runs/*.json (glob reader; honest-empty when absent).
C4-a — Identity continuity (L10/L11): RunDetail.identity_continuity + Runs
Identity tab, sourced from the real core.engine_identity (engine_identity /
parent_engine_identity lineage relation, re-derived to verify).
Demo Theater: renders backend-owned proof-promotion + entailment DAGs.
Phase A residue: density preference wired end-to-end (settings → shell → tokens);
cross-route consistency touch-ups.
Infra: local API CORS now echoes only validated 127.0.0.1/localhost origins
(hostname-checked, not arbitrary reflection) so Vite fallback ports work.
Route chunk-split keeps the build warning-free.
Cleanup: corrected the stale ADR-0175 practice-lane assertions (build_report is
6 correct / 0 wrong / 44 refused after the current serving lane; wrong=0 held)
and the two registry-derived count tests (LeftNav + CommandPalette 12 → 13 for
the new Contemplation route).
Docs: runtime_contracts.md (pipeline-record contract), UI-UX-GUIDE,
api-contract-v1, data-shapes-v1, wave-M-worthiness, phase-a-residue-ledger.
Validation: 106 workbench/practice Python tests green (incl. wrong=0 lane +
pipeline-record fail-closed guards); 459/459 frontend; pnpm build clean;
git diff --check clean. No generate.derivation / reliability_gate / stream /
field.propagate / vault.store imports.
Completes the Wave M B3.5 consolidation slice (b–e), built on #728.
B3.5-b — calibration as a first-class evidence subject (`calibration_class`,
address `calibration:<class_name>`): RightInspector projection + Evidence
Chain Rail semantics (serving-discipline evidence, not runtime truth).
B3.5-c / B4a — nullable `LeewayEvidence` read model threaded through turn,
replay, cognition-proposal, and math-proposal surfaces, with a shared
absence-honest card. B4 is gated correctly: the tuple exists in typed data but
no producer populates it, so the card renders absence (verified: no non-null
producer in workbench/core/chat).
B3.5-d/e — UI-UX-GUIDE.md, b4-leeway-feasibility-gate.md, phase-a-residue-ledger.md.
Practice artifact — earn-it-for-real (runner-reproducible). The committed
`report.json` (additive earns PROPOSE @0.861, 95/5/50) is now emitted by a
deterministic runner rather than copied from the queue. `propose_runner`
gains `regenerate_practice_artifacts()`, which runs ONE sealed `resolve_pooled`
practice pass and writes BOTH report.json (the per-class ledger the calibration
reader consumes) and ratification_queue.json — two projections of one ledger,
coherent by construction and byte-reproducible. `runner.main()` delegates to
it (lazy import, no cycle), so both entry points produce the identical pair.
This closes the gap where a hand-copied report.json agreed with the queue but
no runner produced it. `resolve_pooled` is the aggressive sealed PROPOSE-regime
scorer (proposal-only/HITL, unsafe for serving, legitimate for
attempt-and-eliminate); wrong=5 is the sealed-practice learning signal, NOT the
serving wrong=0. No serving/derivation/reliability_gate source touched; the
practice lane is not in the serving-frozen SHA gate.
Validated:
- python -m pytest tests/test_workbench_{calibration,journal,replay,schemas}.py -> 31 passed
- python -m pytest tests/ -k "workbench or propose or learning_arena or practice"
-> 190 passed (3 failing tests in test_adr_0175_phase2_practice_lane.py are
PRE-EXISTING reds on clean origin/main: stale 4/0/46 assertions on build_report,
which this change does not touch)
- report.json + ratification_queue.json: deterministic (run1==run2) and
reproduced byte-identically by both `python -m ...runner` and `...propose_runner`
- pnpm build green; 144 UI tests across calibration/leeway/evidence/replay/
doctrine-gates/routes-docs-drift all pass
Two corrections from this session's source verification:
- B3.5 D2 (calibration artifact): coherence between report.json and
ratification_queue.json is necessary but NOT sufficient. The 95/50/5 earned
state is a fossil from the disabled resolve_pooled scorer (queue committed in
b82897a0); no current runner reproduces it (main()=6/44/0, candidate-graph
practice=0/1/149). Acceptance now requires report.json be byte-reproducible
by a documented deterministic runner pass; copying numbers between artifacts
is inadmissible. Three routes named (honest-floor now, earn-it-for-real
follow-up, defer).
- C1 (cognitive pipeline visualizer): corrected the false "reader-first over
existing telemetry" framing. Verified the journal persists only ~12 surface
fields of CognitiveTurnResult's ~25; no /trace/{id}/pipeline endpoint. C1-a's
real first deliverable is a persistence change: a curated
CognitivePipelineRecord (never the raw field_state multivectors — O(n^2)
cost), a runtime-contract update, and a non-vacuous fail-closed test.
The docs/proposal-artifact-substrate-v1 work (#727) — wave-m-consolidation-b3.5,
core-logos-studio-plan, proposal-artifact-substrate-v1 — is the authoritative
consolidation and supersedes the parallel 'Phase A' I'd just drafted. Reconciling
to one source of truth:
- FOLD IN the one genuine gap b3.5 missed (a design review caught it): the
Calibration centerpiece undersells — the reader reads the sub-N_MIN committed
practice report.json, so on live data no class shows licensed, while the
earned state (additive 95/5/100, PROPOSE-licensed) sits in the disagreeing
ratification_queue.json. Added as a diagnosis addendum + a Deliverable-2
acceptance criterion (make the committed practice artifacts coherent; show
≥1 earned class). Data-side fix, not a re-derivation.
- FOLD IN the grouped-navigation idea: a field on the route registry
(Deliverable 1) + the organism's-loop grouping (Converse/Cognition/Evidence/
Determinism/Discipline/Substrate/Settings), with the correction that
'core-logos' is the language/manifold Studio surface, not the cognition cluster.
- REDIRECT wave-M-worthiness.md's consolidation section to point at b3.5 instead
of defining a parallel Phase A.
- SCRAP duplicates: wave-M-phaseA-briefs (duplicated b3.5) and
workbench-ui-ux-guide-brief (superseded by b3.5 Deliverable 4).
Boils the design review and the information-architecture decision into one
integration. Phase B's heart (calibration/serving discipline) is done;
Phase A (Structure & Polish) now runs BEFORE resuming Phase C because two of
its items are structural prerequisites the Cognition cluster lands into.
Key synthesis: the command-palette drift bug and the grouped-nav idea are
the SAME fix — navigation derives from one registry that also encodes
structure. Standing IA constraint: one workbench, one address space, one
Chain Rail; grouping is a wayfinding skin, never an architectural fork; no
separate workbenches (the single evidence model is the thesis); 'levels' are
depth-within-a-surface, not top-level categories.
Phase A brief pack (wave-M-phaseA-briefs):
- A1: navigation registry (one source of truth) + grouped nav by the
organism's loop (Converse/Cognition=core-logos/Evidence/Determinism/
Discipline/Substrate/Settings) + palette fix (Demos+Calibration are
currently unreachable via ⌘K; the ⌘1-0 map is stale)
- A2: Calibration earned-state — the centerpiece undersells (reads the
sub-N_MIN report.json; the earned license lives in the disagreeing
ratification_queue). Primary fix: regenerate coherent practice artifacts;
fallback: reader surfaces both with provenance
- A3: Doctrine station ('how this UI can't lie') — elevate contracts/checks
into a first-class surface; trails, larger
Parked: B4 (needs engine-side license stamping; no re-derivation),
Calibration EvidenceSubject kind.
A teach-everything, indexed docs/workbench/UI-UX-GUIDE.md: thesis + evidence
model, the 11 routes (purpose/evidence/usage/states each), the design system
+ primitives, the full keyboard map, the doctrine gates as honesty proof,
replay-in-depth, glossary. Scoped for a mid-tier model: documentation over
shipped code, accuracy-over-completeness, Markdown-only, ground every claim
in the real components. Dispatch-ready.
Wave M takes the workbench to mastery and closes its biggest design gap:
it surfaces the teaching/ratification loop but is blind to the
calibrated-learning / serving-discipline loop (gold-tether arena, reliability
gate, Wilson floor vs θ ceiling, 'the engine earns the right to guess') and
to cognition itself (pipeline stages, field substrate, identity continuity).
Lens: Anthropic + xAI as target users who'd WANT to use it.
- wave-M-worthiness.md: full plan, Phases A–E, the missing-surfaces table,
the backend-reader-first / never-re-implement-engine-math disciplines,
execution order (B→C→D, A parallel).
- wave-M-phaseB-calibration-briefs: executable Phase B pack grounded in the
real core/reliability_gate shapes (ClassTally / conservative_floor /
license_for / Action θ) and the committed report.json evidence — B1
readers (GATING, Python), B2 Calibration route, B3 wrong=0 global frame,
B4 leeway wiring. Dependency DAG + STOP gates + no-theater rules.
First R3 (Theater) piece. Reworks the stale artifact-keyed ReplayRoute into
the turn-keyed hero over the #716 sealed-replay backend, and fully retires
the dead W-026 artifact-keyed machinery on both sides (the NOT_YET_MIRRORED
comment anticipated this).
The hero makes determinism *felt*: pick a journaled turn, CORE re-executes
its prompt in a sealed fresh runtime, and the result renders as a hash
verdict (≡ equivalent / ≠ diverged) + the original/replay DigestBadges + a
leaf diff (critical weighted above informational, each with a ≠ glyph). The
'What this proves' card surfaces comparison_basis + origin_state and states
the honest limit: a divergence means nondeterminism OR origin-state
influence, never rendered on its own as a determinism failure.
Retirement (verified zero serving uses):
- Python schemas.py: removed ReplayComparison/ReplayDivergence/ReplayStatus/
ReplayDivergenceSeverity; scripts/dump-enums.py drops the two replay enums;
both snapshots regenerated (deterministic: dump == committed)
- TS: removed ReplayComparison/ReplayDivergence/ReplayDivergenceSeverity;
added TurnReplayComparison/TurnReplayDivergence (+ basis/origin/severity
unions); NOT_YET_MIRRORED now empty (every engine schema mirrored)
- badges: removed ReplayStatusBadge + ReplayDivergenceSeverityBadge +
meta/enums + their enumCoverage cases (hero renders severity inline)
- api: fetchReplayComparison/useReplayComparison -> fetchTurnReplay/
useTurnReplay (/replay/<turnId>)
- deleted ArtifactList, ReplayComparisonPanel, ReplayDiffViewer,
ReplayMetadataTable, old replay.test.tsx
- App route /replay/:artifactId? -> /replay/:turnId?; conformance row
turn-keyed (loading 'Loading turns...', empty 'No turns recorded yet.')
Tests: ReplayRoute.test.tsx (equivalence hero + honesty card, diverged
critical leaf, informational-only label, replace-mode select, j/k spine).
Full vitest 358 green; workbench Python 34 green; both snapshots deterministic.
Follow-up flagged (not in this PR to keep it focused): the artifact query
hooks (useArtifacts/useArtifactDetail/fetchArtifacts*) are now orphaned but
entangled with the still-live artifact EvidenceSubject kind — a separate
cleanup once an Artifacts route or that subject's fate is decided.
Brief: docs/handoff/wave-R3-briefs-2026-06-13.md (all four R3 pieces).
Replaces the W-026 501 stub. Re-executes a journaled prompt in a sealed
fresh runtime (ChatRuntime(no_load_state=True): no checkpoint load, no
checkpoint write, no proposal lineage) and compares the envelope
leaf-by-leaf against the recorded TurnJournalEntry.
Design correction vs the scoping doc (amended in-doc): journaled turns
each ran in a fresh ChatRuntime(), never one continuous session, so
genesis-PREFIX replay would manufacture spurious divergence; shipped
basis is sealed_fresh_runtime_single_turn (O(1)). origin_state:
"unrecorded" — the journal does not record whether the original turn's
runtime loaded a checkpoint, so divergence is reported as nondeterminism
OR origin-state influence, never disambiguated.
- workbench/replay.py: pure comparison + injected executor; every
TurnJournalEntry field classified critical/informational exactly once
(exhaustiveness enforced by test)
- api.py: route wiring under _CHAT_TURN_LOCK; runtime failure -> 500
runtime_unavailable, no comparison may be fabricated
- schemas: additive TurnReplayComparison/TurnReplayDivergence (W-026
artifact-keyed pair retires with the frontend Replay Moment PR)
- tests: 10 obligations incl. tamper-prompt, tamper-leaf precision,
no-execution-no-comparison, no-trace (journal + engine_state bytes),
wall-clock tolerance, sealed-construction proof
- snapshot regenerated; NOT_YET_MIRRORED debt entries for the two new
classes (mirrors land with the frontend PR)
- api-contract-v1.md § Replay rewritten for the turn-keyed shape
Decides sealed genesis-prefix replay semantics against the actual
constraints (single rolling post-turn checkpoint; journal appended only
by the workbench handler, so history completeness is unprovable today).
Response carries comparison_basis + history_complete so the UI never
oversells; typed refusals; five MEANINGFULLY-FAILS proof obligations.
Reconciles a stale local edit with the upstream roadmap: the deductive
entailment authority demo (PR #700) moves under Demonstrated with its
evidence caveat, and the merged-boundary count is corrected to five
(#687, #688, #690, #696, #700). Next proposed target: Embodied Authority
Simulation Demo.
Brief 4 of the Wave 1 evidence spine — wire the evidence-context architecture
so every route can project into one shared evidence manifold.
Command registry (1A):
- commandRegistry.ts: useSyncExternalStore-backed command store with a cached
snapshot (referentially stable to avoid render loops); useCommands /
useCommandRegistry; recent-items in localStorage (last 10).
- CommandPalette.tsx: reads from the registry; all ten routes are navigation
commands (was Chat/Proposals/Evals hardcoded); fuzzy filter, recent section,
shortcut badges; Router/Fallback split preserved.
- useGlobalKeyboard.ts: Cmd+K palette, Cmd+I inspector, Cmd+1-0 routes, ? help.
Evidence drawer (1B):
- evidenceContext.tsx: EvidenceSubject union (turn|proposal|artifact|
eval_result|none) + useEvidenceSubject hook + EvidenceProvider above the
router Outlet so inspector state persists across route transitions.
- RightInspector.tsx: five evidence projections (was a null stub); reuses the
Brief 2 primitives (MetadataTable, DigestBadge, Timestamp, badges).
- Shell.tsx: visibility driven by inspectorOpen (collapsed by default); no more
hardcoded collapsed=true.
- KeyboardHelp.tsx: shortcut reference dialog.
- TopBar.tsx: palette open state lifted to Shell via props.
Tests: evidenceContext + RightInspector specs added; CommandPalette keyboard
contract updated for the ten-command navigation set (clamp at both ends).
Deferred (noted in spine doc): per-route register()/setSubject call sites,
action-commands (run eval / copy hash), resizable inspector width.
Verified: tsc -b + vite build green; affected specs pass per-file.
Replace blanket no-mutation language with the admitted-corridor rule: ADR-governed path, visible preconditions, auditable telemetry, and replay evidence before action.
Math ratification is documented as the first admitted proposal corridor. Corpus, pack, workflow, arbitrary file, and unadmitted proposal mutation remain forbidden.
SplitPane, TabBar, MetadataTable, DigestBadge, Timestamp, SearchInput.
All token-driven, keyboard-navigable, ARIA-accessible, dark theme,
motion-respectful. No new dependencies — TabBar uses native ARIA
semantics instead of @radix-ui/react-tabs.
PreviewPage updated with all six components in representative states.
Section 1C checked off in wave-1-evidence-spine.md.
Append-only JSONL journal records the exact ChatTurnResult envelope returned by /chat/turn with stable turn_id, trace_hash, all three surfaces, verdicts, and deterministic journal_digest.
GET /trace/turns and GET /trace/{turn_id} serve journal evidence for the Trace route frontend. Read model only; no teaching, pack, or journal-owned engine_state mutation.
Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
Two-pass hardening of the #690 demo so no epistemic state is proposer-mintable:
Pass 1 (sealed corpus, from the reconciliation pass):
- evidence items are references only (evidence_id + content_sha256) resolved
against a committed content-addressed corpus (evidence_corpus.json)
- support derived from committed subject/predicate match; independence from
distinct provenance_root values; proposer support/independence labels are
rejected by the closed schema
- evidence-strength taxonomy (substrate-capability vs interface-contract) in
PUBLIC-DEMO-ROADMAP / DEMO-PACKAGING-CHECKLIST; position-paper refinements
Pass 2 (entailment-decided inference, closes a live false-status hazard):
- the merged inferred leg required only that premise IDs resolve — a claim
with no support citing one unrelated record as a premise was assigned
'inferred' (empirically confirmed). inferred is now decided by
generate.proof_chain.entail (sound+complete ROBDD) over resolved corpus
premises, cross-checked against the independent truth-table oracle
(evals.deductive_logic.oracle, no shared code); proof keys + oracle verdict
in the trace; disagreement => defensive refusal; refutation => contradicted
- committed adversarial scenario unrelated-premise-still-undetermined proves
the attack now lands on undetermined
- corpus seal (corpus_sha256) pinned into every evaluated trace; scope
refusals no longer consult the corpus; corpus cache hands out copies;
claim subject/predicate constrained to atom-compatible snake_case
- .gitignore: private packet dir, agent worktrees, tooling artifacts
Validation: 30 demo tests; 96 across all three demo suites; 7/7 scenarios
double-run byte-identical; 61 architectural invariants green.
The ratified capability, through the existing mutation owner only:
- teaching/proof_promotion.py — pure decider. Fresh-reads every premise AND
the claim from the store (claim_entry_index; forms never proposer-supplied),
strict status compares (no parse-defaulting), reading_certified must be the
boolean True, engine certification via the pinned deductive engine,
proposer_payload accepted and provably never read (del before use; poisoned-
mapping test), certificate digest emitted for D4 trace-hash folding. Zero
mutation; zero vault.store calls; zero status writes (proven with the
INV-21/INV-29 detectors themselves).
- vault/store.py::apply_certified_promotion — the single transition site.
Independently re-verifies: byte-for-byte replay under DEDUCTIVE_ENGINE_PIN,
promotion_positive, live claim form/reading/status cross-checks, live
premise form/reading/status cross-checks (staleness refuses). Fabricated or
tampered certificates flip nothing; authority is live store state plus
recomputation, never the artifact.
- generate/proof_chain/engine_pin.py — DEDUCTIVE_ENGINE_PIN mirrors the
deductive_logic_v1 lane SHA; sync pinned by AST test against
scripts/verify_lane_shas.py.
- Consistency fix found in lookback: both promotion sites now stamp
epistemic_state alongside epistemic_status (the ADR-0148 site left the
stored state tag stale; recall recomputed it, but the stored key lied).
Obligations: all six strict-xfail markers retired and live (O1/O2
strengthened to prove the transition through the vault owner); the
module-existence pin deleted per its own docstring; the two remaining
honesty pins kept. INV-21 allowlist unchanged; INV-29 allowlist unchanged
({vault/store.py}); INV-29's 29c visibility floor raised 2 -> 3 to cover the
new site.
No runtime turn path calls promotion; the deterministic demo is PR D.
Validation: new suite 49 passed; obligations 8 passed (0 xfail remaining);
invariants 66 passed; certificate 27 passed; 0148 6 passed; epistemic 20
passed; smoke files green; lane SHAs verified.
Architect-directed ratification: D1 (pure decider / vault-owned mutation),
D2 (reading stays curator-certified in the first cut), D3 (exact predicate,
including REFUTED -> no transition), D4 (certificate fields + trace-hash
folding), and INV-29 as the permanent transition-site boundary, all ACCEPTED.
Two fail-closed realizations recorded under D3: the claim form is fresh-read
from the claim's own stored entry (never proposer-supplied), and zero-premise
tautology certificates refuse rather than promote in v1.
Docs-only: no runtime behavior changes in this commit. P3 implementation
(teaching/proof_promotion.py + VaultStore.apply_certified_promotion) follows
in the same PR as separate commits.
Pure evidence substrate for proof-carrying coherence promotion. No
promotion, no vault import, no status transition, no teaching-path
change; ADR-0218 stays Proposed.
- generate/proof_chain/certificate.py: frozen PromotionCertificate
(version/claim_form/premise ids+forms+statuses/entailment_trace/
engine_pin/decision/reason, canonical_json with sort_keys+compact
separators); build_certificate runs evaluate_entailment_with_trace
over entry_id-sorted premises; verify_certificate rebuilds from the
embedded forms and accepts iff byte-identical — tampered forms/claim/
trace/decision/reason/ordering/version all fail replay, structural
breakage fails closed as malformed_certificate.
- promotion_positive is necessary-not-sufficient: entailed over a
non-empty all-coherent recorded premise set; REFUTED/UNKNOWN/REFUSED
verify as themselves but are never positive; zero-premise tautology
certificates fail-closed non-positive in v1.
- engine_pin is recorded provenance; pin tampering is caught only via
caller-supplied expected_engine_pin (P3 must pass the lane SHA) —
limit pinned by dedicated tests.
- entail.py: docstring-only fix removing the incorrect ADR-0206
attribution (numbering collision); now cites ADR-0218. Zero behavior
change. generate_claims.py:74 still carries the label (serving-frozen
surface, flagged for follow-up).
- No xfail markers retire: every PR-A obligation binds to the P3
promoter, which must not exist before ratification. The certificate-
shaped halves of O1/O7 are proven for real in
tests/test_proof_chain_certificate.py (27 tests). ADR phasing bullet
and obligations docstring record the reconciliation.
Validation: certificate 27 passed; obligations 3 passed + 6 xfailed;
architectural invariants 61 passed (INV-21/INV-29 green, allowlists
unchanged); entail/builder/rules 61 passed; smoke files 95 passed.
PR A of the stack specified by docs/issues/proof-carrying-coherence-promotion.md.
No runtime change; no promotion behavior; ADR-0218 is Proposed, not ratified.
- ADR-0218 (Proposed): rulings the issue Section 9 demands — extend the
existing mutation owner (policy decides in teaching/proof_promotion.py at
P3, only vault/store.py mutates), reading stays curator-certified in the
first cut, exact fail-closed admissibility predicate, certificate folds
into trace_hash. Records two substrate corrections: proof_chain Phase 2
(2.1-2.4) is already implemented, and ADR-0148 already automates an
energy-arm promotion.
- INV-29 (passing): epistemic-status transition sites are allowlisted.
ADR-0148's in-place promotion proved INV-21's AST scan cannot see
status transitions (they are not store() calls) — the boundary the
issue calls highest-risk did not actually cover the riskiest shape.
Allowlist pinned to {vault/store.py} BEFORE any promoter exists;
detector mutation-proven non-vacuous (29b/29c).
- Obligations O1-O5, O7 as strict xfail (executable spec; ImportError today;
strict=True forces the P3 PR to retire markers and pass for real) + three
honesty pins that flip red if promotion is wired without review.
Validation (worktree off main@187b008b, python -m pytest):
- tests/test_proof_carrying_promotion_obligations.py: 3 passed, 6 xfailed
- tests/test_architectural_invariants.py: 60 passed (56 prior + 4 INV-29)
- smoke file set: 94 passed
- proof_chain/entail/binding-graph/ADR-0148 set: 84 passed
- epistemic/teaching set: 40 passed
- scripts/verify_lane_shas.py: 8/9 pinned lanes match incl. deductive_logic_v1;
public_demo missed on the known env wall-clock budget flake (47.6s > 30s),
pre-existing and unrelated (diff is docs+tests only).
§3.4 said promotion "requires a curator-mediated coherence judgment." That
over-states a necessity. ADR-0021 §3 only requires promotion be a function of
coherence with the reviewed field. For claims *deductively entailed* by
already-COHERENT facts, the entailment proof IS that coherence judgment and can
be machine-certified by the sound deductive_logic_v1 engine — the logical arm of
the "structural coherence metric" ADR-0021's v2 gap already names.
- position_paper.md §3.4: split "own asserted output" (no standing — kept) from
"deductively entailed from COHERENT facts" (proof = coherence judgment);
relocate review to the *reading*, not the deduction; flag the proof-carrying
path as specified-but-unwired with a link to the new issue.
- teaching/epistemic.py: the EpistemicStatus docstring claimed transitions are
"computed from coherence" — they are not; review_correction carries status as
a curator-supplied input. Docstring now states this honestly.
- docs/issues/proof-carrying-coherence-promotion.md: thorough spec for the
unbuilt capability (scope, the reading hazard, INV-21 impact, trust boundary,
falsification tests, phased plan, proposed ADR-0218).
No runtime behavior change. Green: test_epistemic_invariants,
test_epistemic_phase3_state_tagging, TestINV21OneMutationPath (15 passed).
Tool Authority Demo (#688) was still tagged 'draft PR / in review' but it
merged at c55f7dfb. Hybrid Verification Demo (#687) lacked the claims-authority
framing and the agreement-is-not-safety finding. Reposition both as merged
evidence, name the next public evidence target, and align epistemic-state vocab.
- #687 = authority over claims; #688 = authority over proposed tool actions.
- Removed stale 'In progress / draft PR / in review' status on #688.
- Added explicit next-target ordering: Epistemic Truth-State -> Embodied
Authority Simulation -> SaaS/On-Prem Boundary.
- No named-company, outreach, or production/robotics overclaims introduced.
- Explicit System 1/2 framing in thesis and §2 (Claude proposes; CORE decides)
- Named Bounded Transition Guarantee (v2.1) callout box in §2
- Conditioned false-positive claim on correctly specified Anchor (§1)
- Named Type-Safe Local Closure security model in Lens layer and §5 Signal 1
- §7 renamed 'The Ask — Hybrid Mode Wedge' with MCP-shaped experiment framing
- §5 stats (716/716, 0 wrong) explicitly tied to BTG, not tuning/sampling
- §6 Honest Limits: explicit Hybrid vs Native Mode distinction added
- Harmful variant table row: 'licensed scope is a ratified human policy decision'
ADR-0184 S4b — the replay/provenance equivalence boundary, the
precondition for any semantic-primary path. After #685 the in-repo
legacy path delegates to the semantic boundary, so old-vs-new is
vacuous; the durable reference is a pinned canonical trace artifact
(evals/gsm8k_math/equivalence/v1/, 937 problems) whose authority is
the #684/#685 cross-tree differentials (documented provenance chain).
- state/provenance.py: replay_is_faithful — the replay bridge's law as
a checkable structural property (no verify/pool import; covered by
the #685 authority scan).
- equivalence/trace.py: canonical traces (worlds, candidates, order,
multiplicity, classifications, resolutions) + authority_violations
re-deriving the pool commit law from trace content.
- scripts/verify_semantic_equivalence.py: check / --update gate
mirroring verify_lane_shas.py.
- tests/test_adr_0184_s4b_replay_equivalence.py: full-corpus live-vs-
pinned equality, corpus-wide authority + faithfulness, and 17
single-mutation non-vacuity proofs.
Pure additions; verify.py/pool.py untouched; no serving, CLAIMS,
metrics, or lane pins moved.
