Lands docs/briefs/ADR-0246-induced-identity-action-and-path-integrity-preflight.md
(Shay 6e3ccd88, docs-only, +505) on top of main-with-full-Phase-2 (b440b92b).
The PR branched from c7e2b3b6 (pre-2c); this merge reconciles it with the
completed Phase 2 (2a 1c7ea26e / 2b c7e2b3b6 / 2c c0ff4720) so the post-D4
ADR-0246 planning baseline sits on the finished integrity floor. The brief
adds one new file under docs/briefs/ (no code, no ADR status flip, no
governance change) — verified read in full before merge; clean auto-merge
(no path overlap with Phase 2).
[Verification]: content verified (505-line docs-only planning brief, authored
by Shay, consistent with ADR-0244 §4a + D4 plan); merge adds only the brief
file; b440b92b already passed the full fast lane.
evals/adr_0244_identity_gate/ (off-serving, deterministic) measures, honestly:
does the operator-preservation wave gate add identity-attack detection value
the geometry-blind legacy path cannot?
Runs a controlled panel through both paths:
- aligned: small rotations WITHIN the value subspace span(e1,e2,e3) — a
legitimate transformation that preserves the value axes;
- attack: versors that geometrically violate identity — π-rotations that
INVERT a value axis (caught by signed self-alignment ≈ −1), and
rotations/boosts that TILT a value axis toward an alien dimension e4/e5
(caught by the subspace-leakage fraction).
Measured result (pinned by tests/test_adr_0244_identity_gate_eval.py):
- the wave gate separates the panels — every aligned versor admitted, every
attack flagged, min_attack_signal 0.35 > max_aligned_leakage 0.0;
- the two measures are non-redundant (inversion: ~0 leakage but −1 alignment);
- wave adds detection value 6-vs-0 over the legacy path, which never reads
the versor geometry and flags none of these geometric attacks.
Honest scope caveat baked into the artifact + docstring: this is detection
value on the geometric signal the gate is DESIGNED to catch. Whether real
paraphrased injections induce such versor geometry through the live encoder,
and whether the placeholder value axes (e1/e2/e3) are the right identity
directions, is empirical (governance annotation item 6) and is the subject of
D4 Phase 3 (γ_id calibration). The flag stays OFF until that is evidenced.
6 tests + CLI (exit 0 iff separates AND adds detection value).
[Verification]: 6 eval tests passed; CLI exit 0; smoke 176 passed; serve-
quarantine + governance pins 14 passed (eval is off-serving); fast lane
(-m 'not quarantine and not slow' -n auto) 11889 passed, 109 skipped.
Additive-only (new evals/ package + test); no core/chat/algebra changes.
Freeze the post-D4 planning baseline for the next identity ADR series:
lawful stabilizer H_id={I}, induced action A(F), d_orth/d_stab split,
lawful-only path composition with hard ledger breaks, typed residual
channels, admit-or-abstain only, and explicit non-goals (no geometric
C_id, no multi-port framework in this slice).
Implementation starts only after D4 Phase 6 (or explicit waiver). Does
not expand or interrupt the live ADR-0244 D4 arc.
[Verification]: Smoke suite passed locally (314s, 176 passed)
Wires the ADR-0244 §2.2 wave gate into the live turn loop behind a new
opt-in flag, byte-identical when off, plus a normalization fix found in
integration.
core/config.py: RuntimeConfig.identity_wave_gate (bool = False). OFF by
default — the leakage threshold is provisional (reuses alignment_threshold)
until calibrated to gamma_id in Phase 3, and flag-off is byte-identical to
the pre-ADR-0244 advisory path.
chat/runtime.py (main chat() path, two flag-gated touches):
- at the identity check, pass wave_field=result.final_state.F when the
flag is on (so hedging + telemetry both use the wave score); None when
off -> legacy scalar-L2 path.
- after the safety/ethics verdicts exist, intersect their violated
boundaries with the manifold's committed boundary_ids (supplement via
dataclasses.replace) and fold a fail-closed geometric IdentityGateRefusal
into the typed refusal surface (TYPED_REFUSAL_PREFIX). refusal_emitted is
derived once, after the block, preserving the (surface is not None) <=>
emitted invariant.
chat/telemetry.py: serialize_turn_event emits the wave-gate keys
(identity_wave_mode / _leakage_norm / _min_self_alignment /
_boundary_violations) only when identity_score.wave_mode_active — so the
wire format is byte-identical when the gate is off.
core/physics/identity_manifold.py — NORMALIZATION FIX (found in
integration): the live versor carries boost (e5) components, and a boost is
a unit versor (R R~ = 1) that does NOT preserve the Euclidean coefficient
norm, so ‖R a_i R~‖ > 1 and the un-normalized leakage/self-alignment ran
past their ranges (measured leakage 5.16, self_align -4.75 on a real turn).
axis_response now normalizes each measure by the rotated-axis magnitude:
leakage is a fraction in [0,1], self_align a signed cosine in [-1,1]. For a
norm-preserving spatial rotor the rotated axis is unit and normalization is
a no-op (Phase 1 results unchanged). §4a updated to match; new boost test
pins bounded measures.
tests/test_adr_0244_identity_gate_runtime.py (new): flag OFF -> legacy
score + no wave telemetry (byte-identical wire); flag ON -> wave gate active
on the live versor + wave telemetry present + bounded measures; flag-off
determinism. Seeds a short sequence to reach main-path (identity-checked)
turns (a fresh empty-vault runtime routes ungrounded inputs to disclosure).
[Verification]: 74 targeted (manifold+gate+runtime+legacy identity+
telemetry) passed; in-worktree smoke 176 passed; fast lane
(-m 'not quarantine and not slow' -n auto) 11883 passed, 109 skipped —
flag-off byte-identity confirmed across the whole suite.
Extends core/physics/identity.py with the ADR-0244 §2.2/§4a wave-field gate
as a pure, dual-mode capability (no runtime behavior change — the legacy
path stays byte-identical when no wave field is supplied).
- check(trajectory, manifold, *, wave_field=None, violated_boundary_ids=
frozenset()): dual-mode. wave_field present -> operator-preservation
gate; absent -> legacy scalar-L2 (ADR-0010). A MALFORMED wave field
(non-finite / wrong shape / wrong byte-order) raises a typed ValueError
via _validate_wave_field — it never silently falls back to legacy (the
dual-mode fallback is for an ABSENT wave field only).
- _wave_field_score: operator-preservation via IdentityManifoldGeometry
(Phase 1). The trajectory is a versor (operator), so we measure whether
it PRESERVES the value subspace: RMS subspace leakage (tilt toward alien
dimensions) + signed self-alignment (in-subspace inversion). score =
1 - leakage_rms; flagged on score<threshold OR inversion OR boundary.
- IdentityScore extended (wave_mode_active, leakage_norm,
min_self_alignment, boundary_violations) — all defaulted, legacy shape
and construction preserved.
- boundary_ids predicate: violated_boundary_ids & manifold.boundary_ids;
a non-empty intersection is a hard identity-boundary breach (activates
the previously-dormant boundary_ids; item 7).
- IdentityGateRefusal + conjugate_correct (C_id): v1 admit-or-abstain, NO
silent correction of the versor (honors the safety-pack
no_silent_correction boundary); abstains (raises) on violation.
- would_violate extended for boundary + inversion (legacy defaults never
trigger the new branches).
identity_manifold is now imported by identity.py (serve-safe pure algebra);
serve-quarantine transitive test stays green.
tests/test_adr_0244_identity_gate_wave.py (16 tests): dual-mode dispatch,
identity-versor alignment, alien-dimension tilt leakage, in-subspace
inversion caught via orientation, fail-closed malformed validation, the
boundary intersection predicate (in/out of manifold, legacy path too),
C_id admit-or-abstain, would_violate extensions, legacy back-compat,
determinism.
[Verification]: 16 new tests passed; legacy identity + quarantine +
telemetry-fanout suite 54 passed (legacy behavior + serve-quarantine
preserved); in-worktree smoke 176 passed; fast lane (-m 'not quarantine
and not slow' -n auto) 11879 passed, 109 skipped.
Implements ADR-0244 §2.1/§4a: the metric-exact operator-preservation
geometry, pure and off-serve (wired into the runtime gate in Phase 2).
core/physics/identity_manifold.py:
- lift_axis: R^3 pack direction -> grade-1 Cl(4,1) at e1/e2/e3 slots
(basis_vector, not embed_point) so the value subspace lives in the
spatial grade-1 block where <.,.>_0 = Euclidean and the Gram matrix
is positive-definite.
- gram_matrix + ManifoldConditioningError (fail closed when cond(G)>1e5).
- subspace_project: metric-orthogonal P_I(x) with SIGNED coefficients.
- sandwich: versor action R x R~.
- euclidean_norm: positive-definite leakage magnitude (NOT the indefinite
Cl(4,1) norm, which can vanish/negate an e5-boost leakage).
- IdentityManifoldGeometry (frozen): axes_psi + Gram + Gram^-1; .project,
.axis_response -> (leakage, self_align), .leakage_rms.
Operator-preservation, per the ratified core-mechanism correction: the
live trajectory final_state.F is a VERSOR (even-grade operator, zero
grade-1 content), so we measure whether it PRESERVES the value subspace
via F a_i F~, not whether it lives in it. Two per-axis measures, both
required and non-redundant:
- subspace leakage euclidean_norm(rot_i - P_I(rot_i)) catches tilt of a
value axis toward an alien dimension (e4/e5);
- signed self-alignment <a_i, rot_i>_0 catches in-subspace inversion
(e1 -> -e1: leakage 0 but self-align -1).
tests/test_adr_0244_identity_manifold.py (24 tests) pins every falsifiable
claim: G=I for the default pack, idempotent projection, identity versor ->
0 leakage/+1 align, within-plane rotation -> no leak, e4/e5 tilt -> leak,
pi-inversion -> 0 leak but -1 self-align, near-degenerate axes ->
ManifoldConditioningError, determinism.
[Verification]: 24 new tests passed; in-worktree smoke 176 passed; fast
lane (-m 'not quarantine and not slow' -n auto) 11863 passed, 109 skipped;
serve-quarantine transitive test 2 passed (new module is NOT dragged onto
the serve path — off-serve until Phase 2).
Discovered before implementing Phase 1: the live identity trajectory
final_state.F carries the invariant versor_condition(F) < 1e-6 — it is a
VERSOR (even-grade operator, grades 0/2/4, exactly zero grade-1 content).
§2.1/§2.2's literal 'project psi_traj onto the grade-1 value subspace' is
therefore VACUOUS on the real runtime object: P_id(F) = 0 identically,
flagging every trajectory — a fail-closed brick. Root cause: a versor is
an operator, not a state vector; projecting the operator into a subspace
of states is a category error.
Resolution (ratified by Joshua Shay 2026-07-17): measure whether the
versor PRESERVES the value subspace, via its action on the axes
F a_i F~ (sandwich). Two per-axis measures, both empirically verified
necessary and non-redundant:
- subspace leakage = euclidean_norm(rot_i - P_I(rot_i)) — catches a
versor tilting a value axis toward an alien dimension (e4/e5);
- signed self-alignment = <a_i, rot_i>_0 — catches in-subspace
inversion (e1 -> -e1: leakage 0 but self-align -1), the concrete
realization of the ratified 'signed overlap, never abs()' decision.
Keeps the grade-1 pack axes unchanged (no pack migration) and sharpens
inalienability: identity is invariant UNDER transformation, not a frozen
state.
§4a rewritten to the operator-preservation spec (lift_axis, gram_matrix,
subspace_project, sandwich, euclidean_norm, axis_response); governance
annotation item 12 records the reframe + ratification; plan doc §3 Fact C
+ §5 Phase 1 + progress log updated.
[Verification]: docs-only ADR/plan amendment; provenance/ADR guard
(test_adr_0241_governance_p12.py) 6 passed — ADR-0244 Status line
confirmed still 'Proposed' (the item-12 ratification text is inside the
annotation/§4a, not a status flip). All acceptance numbers pre-verified
via in-tree numerical probes against algebra.cl41.
Reconciles ADR-0244 against its own D0 blockers and commits ADR-0245 as
a real companion ADR (previously a dangling reference in ADR-0244 §4).
ADR-0244 governance annotation expanded (11 items, all body text below
preserved verbatim for R&D provenance; annotation governs on conflict):
1. Q_top proof (already landed) now explicitly drops the §2.2 egress
ΔQ_top conjunct (it is a hollow, always-true discriminator).
2. §4-vs-§2 contradiction RESOLVED — new §4a is the governing spec;
§4 kept verbatim as the (contradictory) original R&D sketch.
3. §2.1 axis construction was underspecified (packs ship dim-3
directions, not 32-vectors) — resolved via a grade-1 lift at the
e1/e2/e3 slots (algebra.cl41.basis_vector), not embed_point.
4. §2.2 amended: signed overlap (never abs()'d — anti-alignment must
stay distinguishable from orthogonality); leakage norm is the
positive-definite Euclidean coefficient norm, not the indefinite
Cl(4,1) inner product (which (+,+,+,+,-) permits to vanish for
nonzero leakage).
5. Inalienability reframed as 5 testable layers (algebraic / runtime
/ pipeline / operational / semantic) — only the first is a math
guarantee.
6. Paraphrase-invariance reworded as an empirical, measured property;
Q_top conservation scoped to pure versors only (relax_to_ground
can converge to non-versor superpositions — the ADR-0243 SD-A
subtlety).
7. boundary_ids activation (currently stored, never evaluated).
8. Identity manifold is FROZEN — biography holonomy accumulates
separately and never mutates the identity subspace.
9-11. Filename correction (multimodal_lifecycle.py doesn't exist;
real file is cognitive_lifecycle.py), ADR-0245 cross-link,
theological citation labeled ESV + analogy disclaimer.
New §4a supersedes §4 with a typed, Gram/leakage-correct specification
(ManifoldConditioningError, IdentityGateRefusal, bounded/abstaining
C_id, isfinite + shape guards — no bare assert) for Phase 1/2 to build
against under TDD.
ADR-0245 committed Proposed, verbatim from the R&D export, with a
governance annotation mapping its 4 decisions + Sec 3 acceptance gate
against what the cohesion-directive arc already landed (Rust f32 GP,
_cached_eigh, digest hot-path all done; f64->f32 cast + Sec 3's
speedup/collision proofs open — tracked as D4 Phase 4/5).
Audit doc (adr-0244-cohesion-directive-audit-2026-07-17.md) wrinkles
1-2 and Q5 sequencing updated from 'pending'/'must reconcile' to
resolved, cross-referencing this landing.
[Verification]: in-worktree smoke gate 176 passed; provenance/ADR
governance pins (test_adr_0241_governance_p12.py,
test_adr_0242_topological_quarantine.py, test_third_door_cohesion.py)
30 passed — confirms ADR-0244 stays Proposed (no status flip) and no
existing ADR provenance guard was disturbed. Docs-only change, no
executable surface touched.
Comprehensive phased plan for full ADR-0244 realization (D4) plus the
ADR-0245 companion: locked design decisions (Q_top dropped from egress,
grade-1 axis lift, signed overlap, Euclidean leakage norm, frozen
identity manifold, bounded/abstaining C_id), code-verified ground truth
(Fact A dim-3 axes, Fact B two field surfaces, boundary_ids dormant),
folded-in external-review considerations, and a per-phase progress
dashboard for seamless cross-session resume after rate-limit breaks.
[Verification]: docs-only (docs/handoff/), no executable surface; smoke
deferred to Phase 0 (first phase touching governance/ADR tests).
Turns the D0 "likely vacuous" annotation on ADR-0244 §2.3 into a re-runnable proof
that ΔQ_top = 0 is a hollow egress gate (the #19-pseudoscalar failure mode).
evals/adr_0244_qtop_vacuity/ — computes Q_top = <psi I5 ~psi>_0 on the real
Cl(4,1) algebra and finds: (1) Q_top = 0.000e+00 EXACTLY across every unit versor
(spatial rotors AND boosts through e5, and products) — I5 is central so
psi I5 ~psi = I5*(psi ~psi) = I5 for a unit versor, scalar part 0; (2) off the
versor manifold Q_top = -grade5(psi ~psi), nonzero only where the I-05 closure
residual already fires; (3) it is a conserved Spin(4,1) invariant but identically
0 on the valid manifold; (4) the decisive test — an aligned identity and an
adversarially-rotated one (a valid versor, overlap 0.963) both read Q_top = 0, so
ΔQ_top = 0 PASSES the attack the spectral-leakage/closure check actually catches.
Typed JSON artifact + CLI (exit 0 iff proven_vacuous).
tests/test_adr_0244_qtop_vacuity.py — pins each step + off-serving quarantine.
Docs: ADR-0244 §2.3 annotation upgraded "likely vacuous" -> "PROVEN vacuous —
retire from egress"; audit-doc Q4 marked RESOLVED with the evidence.
Verdict: do NOT wire ΔQ_top = 0 as an egress admit condition; keep Q_top, if at
all, as a closure-derived diagnostic. Closes the first of the two ADR-0244 D4
blockers with proof.
[Verification]: qtop eval 8 tests green; CLI proven_vacuous=true; smoke below.
Cohesion directive Mandate 6 (ADR-0244 §2.4). The Fibonacci search was already
~85% compliant (typed OptimizationFailure, fail-closed, bracketed contract,
never a bare float); this closes the two residuals honestly:
- Rename the failure reason unimodality_violation_multiple_extrema_detected ->
sampled_unimodality_violation_observed. A finite sample cannot prove global
unimodality; the check only *observes* a violation on the evaluated points.
Docstrings now state the Bracketed-Local contract explicitly.
- propose_kappa_from_search: kappa=1.0-on-failure IS the required "parameters
unchanged" no-op (thr = productive_threshold / 1.0), and the typed
OptimizationFailure is already returned as the second element — so the fix is
legibility, not a behavior change (the working seam is preserved, not broken):
the docstring names baseline as an explicit caller-side policy, and a new test
pins that a failed search surfaces the typed failure rather than a bare float.
tests: test_adr_0244_search_honesty pins the renamed reason end-to-end (a
cos(8*pi*x) objective whose golden-section samples are non-monotone triggers it;
a smooth bimodal instead converges to a local-min certificate — the honest
Bracketed-Local distinction), _unimodality_ok as a finite-sample check, kappa
failure legibility + no-op baseline, and that no stale reason string remains.
[Verification]: search-honesty 6 + adr_0242_fibonacci + third_door_cohesion +
carry_seams green; smoke + fast lane below.
Cohesion directive Mandates 1+2 (ADR-0244 §2.6 / §2.8).
Mandate 1 — Rust f64 geometric_product fast-path:
- core-rs/src/lib.rs: export a geometric_product_f64 PyO3 wrapper (mirrors the
f32 one; delegates to cl41::geometric_product_f64, itself a term-for-term
mirror of the pure-Python f64 kernel — same i-major scatter order, no FMA).
- algebra/backend.py: f64 branch in geometric_product, gated on CORE_BACKEND=rust
+ core_rs present (default stays pure-Python; older builds fall through on
AttributeError). The directive's f32 gate was already built; the real gap was f64.
- Contract is BIT-IDENTICAL, not tol-matched: a 1-ULP divergence would move the
f64 wave-field residual bytes and break I-02 replay under CORE_BACKEND=rust.
Verified: test_geometric_product_f64_parity N=10000 Rust-vs-Python bit-for-bit
+ CORE_BACKEND=rust subprocess hex match (core_rs built).
- Measured M1 speedup (sixth acceptance criterion): dense f64 GP ~120x
(Rust 4.3 us/call vs Python 520 us/call) with parity holding.
Mandate 2 — eigh memoization:
- cognitive_lifecycle.py: relax_to_ground's dense-branch np.linalg.eigh routed
through _cached_eigh (functools.lru_cache, keyed on the frozen hamiltonian_id +
matrix bytes), returning frozen read-only (evals, evecs) so a cache hit can
never be mutated — every hit is bit-identical. The diagonal (propositional)
fast path is untouched.
tests: test_adr_0244_mechanical_sympathy pins cached-eigh == fresh eigh,
read-only arrays, hit-returns-identical-objects, and relaxation determinism
through the cache; D9 extended with the N=10000 bit-identity gate and its
now-stale "f64 is Python-only" pins updated.
[Verification]: D9 22 passed (incl. bit-identity N=10000, core_rs built) +
mechanical-sympathy + cognitive_lifecycle green; smoke + fast lane below.
Cohesion directive Mandates 4+5. The ADR-0243 lifecycle modules were the only
content-address sites still truncating SHA-256 to 96 bits (24 hex) and passing
default=str to json.dumps — the rest of the codebase already uses full 64-hex
digests (claim_digest, cert_id, decision_id, pressure_id, ...). The default=str
+ [:24] drift had also just replicated into Lane C (biography_wiring.py).
- cognitive_lifecycle.py: _content_id drops default=str (non-serializable payload
now fails closed with TypeError) + full 64-hex; _psi_digest full 64-hex over
canonical little-endian f64 bytes via a new _le_f64_bytes helper (coercion, not
the assert form the ADR-0244 draft used — assert is stripped under -O);
matrix_sha routed through _le_f64_bytes too.
- biography_wiring.py, self_authorship.py: same _content_id hardening. Verified
every payload is JSON-safe after the existing float()/str() wrapping, so
removing default=str changes no current digest value — only future
non-serializable inputs fail closed.
- On little-endian targets the widening is an un-truncation: the new 64-hex
digest's 24-char prefix equals the old value (pinned).
tests: test_adr_0243_cognitive_lifecycle psi_digest gold updated to full+LE; new
test_adr_0244_semantic_rigor pins full-64 length, fail-closed TypeError, LE
byte-order canonicality (native vs >f8 hash-equal), and determinism.
[Verification]: D1-affected suites 66 + miner suites 23 green; smoke + fast lane below.
First step of the cohesion-directive arc (docs only; no code).
- docs/adr/ADR-0244-…md: committed Proposed, verbatim from the R&D export
(matching the ADR-0241/2/3 landing convention), plus a clearly-marked
governance annotation holding two items open for the D4 implementation plan:
(1) §2.3 Q_top is likely vacuous — central I5 in odd Cl(4,1) collapses the
charge on versor states (the #19 pseudoscalar failure mode); it must not be an
egress gate without an empirical discriminating counterexample; (2) §4's
conformed implementation contradicts §2.1-2.2 (per-axis resonance vs.
Gram-projection/leakage-norm/ManifoldConditioningError), references a dangling
ADR-0245, and uses a bare assert for the byte-order guard.
- docs/analysis/engineering_cohesion_refactoring_directive.md: the technical
directive moved to its own canonical path, verbatim (content byte-identical).
- docs/analysis/adr-0244-cohesion-directive-audit-2026-07-17.md: the code-level
audit of all 7 mandates vs. main@24078b11 — per-mandate verdicts, the six
spec-level wrinkles, the amended mandate→work-item mapping, the missing sixth
acceptance criterion (Mechanical-Sympathy gain), and the five decisions (Q1-Q5).
Notable finding: the default=str + 24-char-digest drift the directive flags was
replicated into Lane C (biography_wiring.py) AFTER the directive was written —
raising the priority of the D1 semantic-rigor batch.
[Verification]: docs-only; ADR governance provenance-guard green (unchanged).
Submits the ADR-0243 arc for Joshua's ruling: claims-vs-evidence, deviations
D-1..D-5, deferred items, and the arc gate results (Phase 4 fast lane 11808;
decisive falsifier wrong==0). Follows the ADR-0241/0242 packet convention.
The Proposed->Accepted flip is NOT made here: the anti-self-Accept guard
(test_adr_0241_governance_p12) requires a recorded human ruling with inline
provenance. Section 8 RULING RECORD is PENDING; the status flip is a separate
one-line governance commit carrying Joshua's ratification, made only after his
explicit ruling.
[Verification]: docs-only; ADR-0243 suite + provenance-guard green.
Completes ADR-0243 Phase 4 (plan §5). Adds the metrics benchmark scoring the
cognitive lifecycle against concrete falsifiable comparison classes, joining the
already-committed decisive propositional falsifier (bdf8146a) under one eval package.
evals/adr_0243_cognitive_lifecycle/benchmark.py — five falsifiable metrics, each
grounded in a live lifecycle primitive (no decorative numbers); typed
BenchmarkVerdict / MetricResult; deterministic, JSON-safe:
- fidelity: decode overlap |<psi_steady, target>| after relax_to_ground on a
quadratic well from a perturbed start (min >= 0.999; measured 1.0).
- surprise separation: energy-above-ground of ID (small rotations of the
identity axis) vs OOD (near-orthogonal rotations into distinct Cl(4,1)
planes) against a fixed identity well; strict margined separation
min_ood - max_id > 0.05 (measured 0.834); lam0 verified ~0, not assumed.
- insertion cost: relaxation certificate.steps_taken — all certified, bounded
(<= 256), real work (max_steps > 0; measured 22-23).
- f32 drift over T=1000: unit versor iterated by a fixed rotor with no renorm;
f64 holds versor closure to 1e-9 (~8e-14 measured) while f32 truncates to
~4.7e-5 (ratio ~5.9e8) — the gap motivating ADR-0244 §2.5/§2.6.
- falsifier: run_propositional_falsifier wrong == 0 (1008 ID + 18 refusal-parity).
evals/adr_0243_cognitive_lifecycle/__main__.py — subcommand dispatcher
(benchmark [default] / corridor / falsifier); non-zero exit on falsification.
tests/test_adr_0243_benchmark.py — pins overall pass, each metric's falsifiable
claim, the genuine f32/f64 drift gap, CLI routing + exit codes, and the A-04
off-serving quarantine.
[Verification]: in-worktree smoke gate 176 passed; fast lane
(-m "not quarantine and not slow" -n auto) 11808 passed, 108 skipped;
serve-quarantine + third-door cohesion + dispatch hygiene 22 passed; Phase 4
tests (benchmark + falsifier) 17 passed; benchmark overall_passed True
(deterministic across runs).
The propositional slice of ADR-0243's falsifiability benchmark (plan §5 Phase 4),
the arc's load-bearing evidence. Two mechanism-disjoint engines decide the SAME
enumerated propositional problems:
- Field decoder: propositional_entails (Cl(4,1) wave-field ground energy).
- Gold: generate.proof_chain.entail.evaluate_entailment (exact ROBDD tautology
check, ADR-0201 keystone) — genuinely independent, not the field checking itself.
A clause→string bridge (render_clause: `a | ~b | c`) lets both engines decide
byte-for-byte the same problem. Result over the enumerated panel (atoms a,b,c;
premise sets size ≤2):
- 1008 satisfiable-premise ID comparisons: field.entailed ⇔ gold is ENTAILED —
wrong == 0.
- 18 inconsistent-premise cases: field discloses satisfiable_premises=False
exactly where gold returns REFUSED — matched refusal, no ex-falso leak.
- OOD (>5 atoms): field decoder refuses by construction while gold still decides
— the honest ID/OOD scope boundary in the propositional domain.
Deterministic (enumerated, no randomness/wall-clock); off-serving (evals/ only,
chat/runtime non-import pinned).
[Verification]: tests/test_adr_0243_propositional_falsifier.py — 6 passed;
run_propositional_falsifier() → wrong=0 over 1026 field-vs-gold decisions.
Wire the ADR-0242 §5 pinned primitives into the contemplation runner
(ADR-0243 §2.4): contemplate_surprise_history() gates the newest
caller-timed ADR-0239 dual-operator observation through
is_discovery_eligible, the measured history through
cross_band_discovery_gate (F5/F6/F7 persistence), and only then emits a
DiscoveryCandidate via the existing emit_surprise_discovery ->
DiscoveryCandidateSink. Proposal-plumbing only: the sole side effect is
sink.emit().
Surprise-signal sourcing (the Lane A open question): ContemplationFinding
carries no surprise measurement and the report-mining paths have no
geometry, so nothing is fabricated for them — the canonical carrier is
the ADR-0239 dual audit dict (SelfAuthorshipMiner / ADR-0240 harness),
consumed as explicit SurpriseObservations with caller-supplied logical
time (deterministic, no wall clock).
Give propose_kappa_line_search its live caller (ADR-0242 §5-P1):
evals/analogical_transfer/kappa_calibration.py calibrate_transfer_kappa,
confined to the ADR-0240 calibration pipeline per R-04; kappa_search_event
fires exactly once when a sink is passed. Proposal-only — no
GoldTetherMonitor mutation.
A-04 hardening found during review: chat/runtime.py idle_tick lazily
imports core.contemplation.runner inside the serve process, and the
package __init__ eagerly pulled wave_seam -> holographic_vault (a
serve-banned module) — a PRE-EXISTING process-level quarantine breach.
Closed by making the wave-seam re-exports lazy (PEP 562) and keeping the
multi_scale_energy gate import function-local; pinned by a new dynamic
idle-tick-edge test in test_serve_quarantine_transitive.py.
Pinned primitives untouched: is_discovery_eligible,
cross_band_discovery_gate, candidate_from_surprise_dual signatures
unchanged; no changes to cognitive_lifecycle.py or chat/runtime.py.
New evals/adr_0243_cognitive_lifecycle/ composes AudioCompiler/VisionCompiler ->
sensorium_wave_feed -> relax_to_ground/CognitiveLifecycleEngine.egress ->
generate/realizer readback -> explicit GoldTetherMonitor.decide into one
deterministic fixed-replay corridor, per
docs/handoff/ADR-0243-PHASE3-BRIEF-PACK.md Brief B. Pure composition of
already-tested organs; no new core.physics module; OFF-SERVING (evals/ only,
never imported by chat/runtime.py).
Relaxation targets the full audio+vision integrated percept but starts from the
audio-only partial percept (engine.solve() is not used, since it ties start ==
target) so the relaxer decodes across real steps rather than starting
already-converged; stages are driven explicitly and reassembled into one
LifecycleOutcome keyed off the full percept.
[Verification]: uv run core test --suite smoke -q (176 passed); sensorium suite
(152 passed); algebra suite (82 passed, 50 skipped); new
tests/test_adr_0243_sensorium_corridor.py (6 passed, includes a
steps_taken > 0 pin against silent regression to a no-op relax, a cosine/ANN-free
static pin, and a chat/runtime.py non-import pin).
First live caller of integrate_biography (previously zero production call
sites). New core/physics/biography_wiring.py: report-level PASS gate
(report.wrong == 0 AND >=1 correct transfer; refusals don't block but
all-refused validates nothing), I-01 closure asserts re-checked at the
wiring seam (fail-closed typed BiographyIntegrationError), and a net-new
append-only BiographyProvenanceRecord binding report evidence to the
integrated trajectory hash (AuthorshipProposal-style closure proof in a
TurnEvent-style audit role).
Design ruling (Shay, 2026-07-17, brief open question): direct integration,
structurally pinned — integrate_biography is a pure recompute
(reconstruction-over-storage), so D-5/I-03 proposal gating does not attach;
the ruling is enforced by a test pinning that the wiring imports no vault
store and no evals package (report typed structurally, no core->evals
import). Module registered in the never-serve lazy tier + _BANNED +
third-door banned lists. cognitive_lifecycle.py untouched (Lane C touches
zero Phase-2 code).
Phase 2 merged (#56) after the brief pack was written; feat/adr-0243-phase2-lifecycle
no longer exists. Lane B's base/worktree instructions pointed at it. All three
lanes now branch off forgejo/main directly, per the actual current state.
Orthogonal docs-only fix, direct push (no code/tests touched).
Production-line brief pack for the three independent Phase 3 wiring lanes,
each grounded in fresh read-only research against the current worktree (not
assumed from the plan text):
- Lane A (discovery wiring): is_discovery_eligible + cross_band_discovery_gate
-> DiscoveryCandidate via the contemplation runner's existing sink; live
caller for propose_kappa_line_search so kappa_search_event fires. Flags a
real open question (what feeds surprise_norm for a contemplation finding)
rather than guessing.
- Lane B (sensorium corridor eval): first live consumer of the I-04 feed —
real Audio/Vision compilers -> cognitive_lifecycle -> readback -> GoldTether,
shaped like the adr_0242_v2_energy_compare fixed-replay template.
- Lane C (biography wiring): ADR-0240 harness PASS -> integrate_biography with
I-01 closure asserts and provenance recording. Flags a genuine
identity-substrate design question (mutation vs. proposal-only) for Shay
rather than picking silently.
Corrected dependency DAG: only Lane B actually depends on Phase 2's
cognitive_lifecycle module landing. Lanes A and C touch zero Phase-2 code —
every symbol they wire already exists on forgejo/main — so they can start
immediately, in parallel with Phase 2's own review, rather than waiting.
Also fixes a stale claim this research caught: the plan's substrate table
(Sec 2) named packs/en/readback_rules.py as already-landed §2.3 readback
rules. That file was deleted under audit ratchet W-006; the live substitute
is generate/realizer.py:energy_modulated_surface. Corrected in place.
Per standing production-line-pattern + no-self-dispatch doctrine: brief pack
only, dispatch is Shay's call.
[Verification]: docs-only change, no code touched; no test suite affected.
Implements ADR-0243 §2 honestly per the plan's deviations ledger, correcting
the §3 sketch's three pinned defects (SD-A/B/C):
- Ingress delegates superposition to sensorium_wave_feed, normalizes once at
the owned construction boundary (D-3).
- Relaxation is the imaginary-time semigroup psi <- normalize(exp(-(H-lam0)*dt)*psi)
(D-1) with a certified, never-assumed convergence certificate (D-2): exact
ground energy, achieved Rayleigh energy, eigen-residual, spectral gap, and a
psi_digest binding the certificate to the exact state it certifies.
- Two checkable problem domains: quadratic_well (convex target-decoding) and
propositional (Cl(4,1) blade lattice = assignment lattice of <=5 atoms;
diagonal penalty Hamiltonian; entailment via UNSAT(premises & !conclusion)
scored against independent truth-table gold).
- Egress composes unit-amplitude-density + certificate-binding + versor
closure (routes, does not admit, per the dual of SD-A) + ADR-0006 energy
classes + E0/E1 crystallization policy. Cold states emit a
CrystallizationProposal (epistemic_status pinned SPECULATIVE by the type;
D-5/I-03) — never a vault write.
- Quarantined off-serving (A-04): lazy barrel export, banned in the
transitive subprocess probe and the cohesion AST suite.
Adversarial verification (finder/verifier workflow; most verify agents lost
to a session limit, every surviving finding reproduced in-tree before acting)
surfaced and this closes two real defects beyond the plan text:
- egress_gate admitted any unit state paired with any converged certificate
from an unrelated run, so CrystallizationProposal could package a foreign
psi_digest next to an unrelated certificate_id as false provenance. Fixed
by binding the certificate to its state (psi_digest) and refusing mismatches
(certificate_state_mismatch).
- A state with a spectral gap below the requested tolerance could certify
with ZERO ground-space overlap (energy window alone can't resolve it).
Certification now also requires the excited weight (E-lam0)/gap <= tol
(refusal spectral_gap_below_tolerance), and the degeneracy cluster is
capped at the acceptance window so certificates report the honest
rate-limiting gap instead of absorbing a hairline split.
38 tests (31 original + 7 hardening: certificate-binding must-reject,
gap-refusal + true-ground pair, dense-branch (eigh) refusals, iterate-collapse,
Hamiltonian/egress shape must-rejects, E2 hold route, hardcoded canonical
entailment verdicts independent of the gold function's code shape).
[Verification]: lifecycle+pins+cohesion+transitive 58 passed; in-worktree
smoke 176 passed (131s); fast lane 11750 passed, 108 skipped (574s, exit 0).
Commits the ADR-0243 (Wave-Field Cognitive Lifecycle) proposal verbatim as
Proposed, and the arc-governing implementation plan derived from it plus
docs/analysis/core_cohesion_master_plan.md and the ADR-0241/0242 post-Accept
close audit findings.
The plan records that most of ADR-0243's organs already exist on main
(sensorium feed, WaveManifold, energy classes, GoldTether, surprise/discovery
plumbing, self-authorship, biography, packs/en readback) and that
tests/test_third_door_cohesion.py already pins I-01..I-05, A-02/A-04, and
core_ha absence from the cohesion master plan — so this arc is the §2.2
relaxation reasoner plus three wiring lanes, not a rebuild.
Also pins three defects in the ADR's §3 reference prototype so it can never
be ported verbatim: the egress gate's antisymmetric quadratic form is
identically zero (rejects every state, valid or not); the unitary
relaxation loop cannot dissipate toward a ground state (the honest
relaxer is the imaginary-time semigroup); and the prototype's block-matrix
"pseudoscalar proxy" is a different operator from the real Cl(4,1)
pseudoscalar action despite sharing I^2 = -Id.
[Verification]: uv run core test --suite smoke -q -> 176 passed (133.41s);
uv run python -m pytest tests/test_adr_0243_sketch_defect_pins.py tests/test_third_door_cohesion.py -q -> 19 passed (0.93s)
Complete remaining W5/post-pivot backlog without Docker CI: INV-21 allowlist
dedup, -n auto fast/full defaults, frozen f64 GP Python SOT suite, real
sensorium compiler → ψ → algebraic ρ feed, V2 fib/dyadic/log fixed-replay
evidence without production energy promotion, and project doctrine restored to
local-first + ubuntu-latest:host (no Docker CI for merge).
[Verification]: Smoke suite passed locally (145s, 176 passed); make test-fast
(-n auto) passed twice (11709 passed, 108 skipped each ~11–12 min).
Lands Shay's own correction (authored 2026-07-16 as commit 798c6d1c in
the primary checkout, never pushed): tea frequently hangs/times out
(Cloudflare 524) via HTTP/2 proxying and WAF handoffs — use the Forgejo
MCP tools instead. Also fixes two references the Local-First CI
Validation Protocol section had left stale: the smoke suite is 175
tests, not 108+ (parity-pinned by test_cli_smoke_suite_covers_ci_smoke_gate),
and PR creation goes through the Forgejo MCP tools, not `tea pr create`.
The operational W0-W5 plan that drove the arc was never committed — it
lived only as a gitignored .claude/plan/ artifact in an orphaned
worktree. This commits the durable plan-to-outcome record: phase-by-phase
status against the original plan, the unplanned CI-collapse/local-first
pivot that consumed the post-ratification session, and the remaining
backlog.
Ports the runner-migration doctrine (authored by the Gemini session against
a stale checkout; grafted here onto current main so the #40-era Local-First
protocol section is preserved, not clobbered):
- CI jobs dispatch to a local Act runner on the primary developer's Mac
(label ubuntu-latest:host = native macOS host execution; the ubuntu name
is a fiction — no Linux-only steps).
- The GCP e2-micro server-side runner was REMOVED 2026-07-16; never
re-provision it (1GB RAM, OOM class). A waiting queue while the Mac is
asleep is intentional — pre-push local gates are the real discipline.
- Workflows remain canonical and install the locked universe (uv sync
--locked, committed uv.lock). GitHub mirror Actions are billing-locked
dead signals.
- CLAUDE.md gains a one-line pointer (policy stays in AGENTS.md).
[Verification]: smoke suite passed locally (175 passed); docs-only.
A parallel session re-implemented the ADR-0241/0242 memo reference sketches
as 'production-ready' files and requested a commit, unaware the repo carries
the ratified implementations (Accepted 2026-07-15). Assessment: two genuine
defects in the memo SKETCH (index overflow; bracket-collapse ratio — now
pinned in the committed memo copy's §4 audit note), one wrong-math 'fix'
(diag[8:16] pseudo-reversion), one self-refuting verification claim (the
submitted orchestrator contains a syntax error and cannot import), and a
new module violating no-scipy-as-truth / P7-retired-polar / zero-fabrication
/ T1-T2. No live checkout was touched (verified). Recommendations: dispatch
briefs point at repo + living summary §12 before Drive docs; Accepted ADRs
get extensions, never re-implementations; unverifiable green claims are red.
[Verification]: docs-only; tree code byte-identical to gated main.
