Local deterministic public evidence for the ratified PCCP capability:
proposer submits claim + proof candidate + status/confidence garbage; CORE
ignores proposer authority, fresh-reads curator-certified store state,
recomputes the proof under the pinned engine, and promotes/refuses only
through VaultStore.apply_certified_promotion. The trace proves the decision.
- demos/proof_carrying_promotion/{schema.json,authority.py,run_demo.py}:
closed recursive schema (output fields unsuppliable at the root), the REAL
decider (teaching.proof_promotion.certify_promotion) and the REAL owner —
no demo-local promotion reimplementation. The local arena is rebuilt via
VaultStore.from_dict over dict-literal metadata: demos/ is scanned by
INV-21/INV-24/INV-29, and the demo adds no vault writer, no recall site,
and no status-transition site (proven in tests with the invariants' own
detectors).
- 8 fixtures + pinned expected artifacts: entailed-promotes,
proposer-status-ignored, non-coherent-premise, uncertified-reading,
tampered-certificate (fails byte replay), stale-premise-status (same
honest certificate digest as the promoting run — live state is what
differs), non-sequitur, invalid-state-smuggling (rejected before
evaluation, authority_evaluated=false, null digest).
- Hardened runner per the #688/#690 pattern: default out/ dir, unsafe
output roots refused, --write-expected explicit, double-run byte-identity
enforced per fixture, scenario pass/fail summary.
- tests/test_proof_carrying_promotion_demo.py (26): expected-artifact
conformance, tamper detection, proposer-garbage decision-invariance (incl.
on the promotable setup), refused-cases-mutate-nothing, REFUTED-never-
demotes, trace-hash folds certificate digest, forbidden-import/call scan
(incl. uuid/random/time), INV-21/INV-29 allowlists pinned unchanged, no
named-company/strategy terms.
No runtime turn integration; promotion remains SPECULATIVE->COHERENT only;
README carries the full honesty ledger.
This demo assigns epistemic truth-state only and runs no normative/
safety/ethics clearance pass, so it has no basis to positively clear
a claim. Drop the verified->cleared mapping: verified now reports
normative_clearance=unassessable like every other non-invalid output.
Updates authority.py, regenerates the affected expected trace hashes,
tightens the test (verified asserts unassessable) and adds an invariant
test that no non-invalid output is ever cleared, and corrects the README
honesty ledger.
A model-style proposer submits a claim, evidence bundle, and optional
bounded-inference block; CORE alone assigns the typed epistemic state
drawn from the canonical core.epistemic_state taxonomy (no parallel
enum) and emits a deterministic, replayable evidence artifact.
The proposer cannot set assigned_state, status, trace_hash,
authority_path, evidence_ledger, or normative_clearance: the closed
recursive schema rejects any root-level injection before state
evaluation runs, and proposer-supplied proposed_state/trace_hash are
recorded as ignored and never read.
Adds closed schema, six fixtures, pinned expected artifacts, a
double-run byte-identical runner with hardened output-dir policy, and a
22-test suite. No network, subprocess, eval/exec, model API, or side
effects beyond demo output.
A narrow, auditable proof path for the hybrid-mode boundary: a
Claude/Fable-style System 1 proposer submits an MCP-shaped tool call
(core.semantic_derivation.verify); CORE re-derives via the ADR-0184
derivation lane, keeps sole acceptance authority, refuses or asks when
it cannot honestly answer, and emits a deterministic replay/provenance
trace for every decision.
Boundary properties (each pinned by a failing-if-removed test):
- the proposer has no commit path: additionalProperties:false schema,
and the demo modules import nothing from generate.* (AST-scanned with
a planted-bypass self-test) — the lane is consumed only through the
ADR-0184 S4b audited trace facade;
- 'verified' requires pool commit AND clean commit-law/faithfulness
audits AND a gold-audited envelope.json entry AND byte-match to the
pinned derivation trace (measured: 118 of the off-serving pool's 231
corpus commits disagree with lane gold, so a bare pool commit is
never served — scenario s4 shows the refusal on a commit that even
matches gold);
- the ask leg is the real Q1 stack (router -> limitation -> Q1-D
producer -> carried handle -> gated serving), dark by default,
tamper-fail-closed on the content hash;
- authority_path names only consulted authorities; responses are
deterministic (double-run byte-identical) and pinned under expected/.
No serving/runtime change; no CLAIMS/metrics/telemetry/lane-pin
movement; no network or Anthropic API dependency (System 1 payloads are
clearly-labeled static fixtures).
