Authorized by Shay (2026-07-17 standing instruction: all-green -> push/merge
direct to main, no PR). Both ADRs land **Proposed** — this merge is NOT a
status flip. Everything pure/off-serving; no serve consumer, no flags changed;
zero-bound operators only; append-only content-addressed replay.
[Verification]: smoke 176 passed; Ring 2/3 + ADR-0246 + D4 gate surfaces 125
passed; run log docs/audit/artifacts/ring2-ring3-runlog.txt
Rings 2 and 3 of the ADR-0246 preflight §9, built exactly as the brief bounds
them. ADR-0247 + ADR-0248 both **Proposed** — no self-Accept.
Ring 2 (core/ports/residual_protocol.py — ADR-0247):
the 7-stage shared control grammar: witness -> typed residual decomposition
-> permitted operator selection -> bounded operation or abstention ->
re-certification -> action decision -> append-only replay record.
Port-agnostic (no registry, no unified scheduler — §7 non-goal #2 honored);
v1 operators are ZERO-BOUND only (nonzero fails closed — no-silent-correction
doctrine); unaccounted residual fails closed; re-certification RAISES on
witness drift during a zero-bound pass; replay chain is append-only,
full-SHA-256 content-addressed, tamper-evident (verify_replay_chain).
NOTE: named core/ports/ because core/protocol/ is the existing CTP v0 wire
format (collision checked before naming).
Ring 2 adapters (core/ports/adapters.py): IdentityPort (ADR-0246 grade-1
geometry; typed channels travel IN the witness so decompose is a pure
re-shaping, no hidden state; admit = evaluate_admission, single source of
truth) + PrecisionPort (ADR-0244 §2.5 cast transport; ServingState subjects)
— two genuinely non-identical native geometries + a synthetic third port
proving grammar agnosticism.
Ring 3 (core/ports/integrity_handoff.py — ADR-0248):
the coordination seam ('Integrity coordinates handoffs; it does not replace
content-bearing cognition'): fuses Ring-2 port decisions + existing
EpistemicState/NormativeClearance into content-free proceed/hedge/abstain
(conjunctive, strongest-restriction-wins; fail-closed on missing/invalid
evidence; binds replay-chain tip digest; handoff itself content-addressed).
Weak epistemic standing hedges (mirrors hedge doctrine) — only integrity
violations silence a turn. OBSERVE-ONLY: no serve consumer yet; that is a
future flag-gated unit. Remaining Ring-3 programme honestly listed open
(world-model, governed-learning consumption, discourse widening).
Both pure/deterministic/off-serving (A-04 pinned); brief §0a/§9 updated.
[Verification]: uv run core test --suite smoke -q => 176 passed; Ring 2/3 +
ADR-0246 suites + D4 gate surfaces => 125 passed (28 new Ring-2/3 pins);
run log docs/audit/artifacts/ring2-ring3-runlog.txt
Opus 4.8 audit of Fable's slice-1 scaffold + authorized hardening (Step 2).
Stacked on feat/adr-0246-slice1-scaffold. Not a PR, not merged, no status flip.
AUDIT (Step 1) — VERDICT PASS. Re-derived A(F)/d_orth/d_stab/typed channels from
§3.1/3.2/3.6 independently: BIT-EXACT vs impl (0.00e+00). Confirmed in code (not
just comments): H_id={I} locked (singleton hardcoded, no enlargement path); path
composes lawful only, refused=break marker, never raw, never soft-I; no §7 scope
creep; serve byte-identity. Finding F1 (doc, not bug): composition uses the raw
CERTIFIED action (required for §6.2 accumulation, else A_path≡I detects nothing) —
now documented for ADR ratification.
HARDENING (Step 2):
§3.7 pure surface (identity_action.py): AdmissionPolicy (calibrated flag),
evaluate_admission (admit-or-abstain, no corrector); CERTIFIED_GAMMA_ID pinned
== identity._WAVE_LEAKAGE_BOUND; all other bounds UNCERTIFIED placeholders.
§3.7 SERVE WIRING (Steps 2.1/2.2): new default-off flag identity_action_surface
(config); threaded chat/runtime -> check -> _wave_field_score; refusal folds
into flagged -> existing would_violate/conjugate_correct abstains; IdentityScore
gains action_surface_active/d_orth/d_stab (legacy defaults). Flag-off is
byte-identical (D4 gate surfaces green unchanged; smoke 176 post-wiring).
§6.3 DISCRIMINATION REPORT (evals/adr_0246_discrimination) — HONEST numbers:
benign pass 0.00, false refusal 1.00, adversarial detect 1.00, control pass
1.00; d_stab AUC 0.375 (95% CI [0.15,0.62]) — BELOW chance. Benign cognition
sits ~18x farther from the frame (mean d_stab 27.8) than the attacks (1.55).
The gate refuses everything and does NOT discriminate; must stay off; usable
separation needs the §11 grounding work, not threshold tuning. Claims language
enforced: 'lawfulness relative to the declared frozen frame', NOT 'semantic
inalienability'.
Ledger raw-sneak hardening test (Step 2.3): mixed lawful/refused sequence must
equal the lawful sub-product, fails if raw sneaks into A_path_lawful.
Handoff to Sonnet: §4.1 per-turn record, path-ledger serve integration, ADR-0246
body + acceptance packet (Proposed, no self-Accept), §11 grounding-feasibility.
[Verification]: uv run core test --suite smoke -q => 176 passed (post-wiring);
ADR-0246 suites 80 passed; egress wiring + D4 gate surfaces 47 passed
(byte-identity); §6.1/6.2 eval 14/14; discrimination report numbers above.
See docs/audit/adr-0246-slice1-opus-audit-and-hardening.md + run log.
BOUNDED AUTONOMOUS SCAFFOLD DRAFT (Fable 5) — not a PR, not merged, no status
flip, no main push. For Opus 4.8 + Shay audit before anything proceeds toward main.
Stacked on the verified §3-primitives + §3.4/3.5-ledger stack (reuse, not re-derive;
all descend from main @ 04d67ca5).
Adds (directive steps 3-4):
+ evals/adr_0246_geometric_suite/ runnable §6.1 synthetic geometric suite
(identity, pi-inversion, 90deg-permutation, mild drift, alien tilt e14,
boost e15, near-singular Gram, malformed F) + §6.2 path/holonomy suite
(lawful sequence, small-rotation session accumulation, interleaved refuse,
pack-change hard break, raw!=lawful forensic). 14/14 cases pass.
+ tests/test_adr_0246_geometric_suite.py pins every case + explicit §6.1 pins
(pi-inversion s=-1, 90deg s=0, near-singular Gram error, malformed-F error)
+ identity_manifold.py: MalformedVersorError + _validate_versor guard on
induced_action / typed_residual_energy (§6.1 fail-closed on malformed F)
+ docs/handoff/adr-0246-slice1-scaffold-notes.md placeholder list, §5-§7
uncertainties, constraint-compliance record, explicit Opus/human TODOs
+ docs/audit/artifacts/adr-0246-slice1-scaffold-runlog.txt actual run output
Constraints honored: H_id={I} only; no soft-projection of unlawful A; path
composes lawful actions only (never raw product); no C_id corrector; chat/runtime,
flags, D4 gate wiring untouched (A-04 quarantine pinned); no discrimination report,
no ADR body, no claims language (deferred TODO: Opus/human); D4 plan not modified.
epsilon_turn/epsilon_session are UNCERTIFIED PLACEHOLDERS, never baked into a
module default (PathBudget is caller-supplied) — flagged in notes + run log.
[Verification]: uv run core test --suite smoke -q => 176 passed;
python -m evals.adr_0246_geometric_suite => 14/14 all_passed;
ADR-0246 suites + adjacent D4 identity surfaces => 114 passed (see run log).
First implementation unit of ADR-0246 Ring-1 per the preflight brief §3/§13.
Promotes the induced-action apparatus from the slice-0 eval prototype into pure,
tested geometry — the single source of truth both the future gate surface and the
§11 grounding-feasibility study will consume.
core/physics/identity_manifold.py:
+ induced_action(versor) A(F) = G^-1 · <a_k, F a_j F~>_0 (§3.1)
+ orthogonality_defect(versor) d_orth = ||A^T G A - G||_F (§3.2)
+ typed_residual_energy(versor) e4/e5/spatial_foreign/unclassified (§3.6)
+ orthogonality_defect_of_action / SPATIAL_GRADE1_INDICES / E4,E5 index pins
core/physics/identity_action.py (new, pure):
+ IdentityStabilizer (locked singleton H_id={I}, §3.3)
+ stabilizer_defect d_stab = min_H ||A - H||_G (§3.2)
G-weighted norm reduces to Frobenius at G=I (default pack)
evals/adr_0246_mismatch_diagnostic: rewired to delegate to the canonical
primitives (removes the duplicate prototype copies; drops unused import).
Scope: off-serving (algebra-only, A-04 quarantine, pinned by test); no gate,
threshold, axis, H_id, corrector, or flag change. identity_wave_gate stays
default-off. Path ledger (§3.4/3.5), gate admit surface (§3.7), and the eval
matrix + §11 feasibility study are subsequent units (brief §0a records the
sequencing). No self-Accept.
[Verification]: uv run core test --suite smoke -q => 176 passed;
tests/test_adr_0246_induced_action.py 12 passed (RED-first);
identity surfaces (mismatch-diagnostic rewired, identity_manifold, identity_gate
wave/runtime/eval, gamma_calibration) 87 passed.
Approved by Joshua Shay 2026-07-17 for merge of feat/adr-0246-slice0-diagnostic,
subject to verification (all confirmed this turn from the exact merged tree):
- deliverables present: evidence packet, raw JSON artifact, eval module (__init__
+ __main__), 16 ground-truth pins
- smoke reproduced: 176 passed
- synthetic reproduced: 16 ground-truth pins passed (9 synthetic constructions
classify correctly before touching live data)
- adjacent identity reproduced: 59 passed (gamma_calibration, identity_manifold,
identity_gate wave/runtime/eval)
SCOPE OF THIS MERGE (explicit, per the approval): this lands slice 0 as a
QUARANTINED DIAGNOSTIC EVIDENCE ARTIFACT ONLY. It does NOT authorize changing the
D4 gate, thresholds, frozen identity axes, H_id, correction policy, or live-serving
state. identity_wave_gate remains default-off and NOT authorized for activation.
The eval package is off-serving (A-04 quarantine, pinned by
test_diagnostic_is_not_imported_by_serving); no runtime/policy/pack surface is
modified (pinned by test_gate_flag_and_bound_untouched).
Finding: benign nominal-frame mismatch = structural foreign leakage (e4/e5
mixing-plane dynamics); semantic coupling to the declared frame is absent (declared
frame statistically indistinguishable from 32 random control frames); precision
transport (<=3.6e-5) and path accumulation ruled out. Confirms and sharpens the D4
root cause: no fixed spatial grade-1 frame is dynamically stabilized.
See docs/audit/adr-0246-slice0-mismatch-diagnostic-2026-07-17.md.
Governance flip carrying Joshua Shay's ratification provenance inline (ruling
2026-07-17: "Ratify both"). Anti-self-Accept guard satisfied — status flips are
authorized by explicit human ruling, not self-issued.
- ADR-0245 → **Accepted** (clean): mechanical-sympathy + semantic-rigor §3 gate
green — parity, f32 467× speedup, 0-LAPACK-on-repeat, collision-resistance.
- ADR-0244 → **Accepted as an implemented mechanism** with a RATIFIED
live-activation limitation: identity_wave_gate stays default-off and live
activation is NOT authorized. Acceptance covers the operator-preservation
manifold, fail-closed gate capability, γ_id calibration, telemetry, and
lifecycle contracts — not a production flip. The Phase-3 calibration explicitly
did NOT authorize activation (benign traffic not separable at the nominal
frame; best balanced error 0.346). Activation is blocked pending a separately
ratified ADR-0246 (induced action, lawful stabilizer, path integrity,
semantic-frame discrimination) + renewed discrimination evidence + acceptable
benign refusal rate + explicit human ratification.
Governance additions (per the ruling): both ADR status lines carry
"Accepted — ratified by Joshua Shay … acceptance-packet" (provenance-guard
format); ADR-0244 header carries the Operational-status limitation paragraph + a
machine-readable identity_wave_gate: ledger block (implementation: accepted /
live_activation: not_authorized / default: off); both packet §8 RULING RECORDs
RATIFIED with the "not safe-to-activate" caveat prominent. Plan doc Phase 6 → DONE.
[Verification]: smoke 176 passed; provenance/ADR pins + all ADR-0244/0245 tests
503 passed (both-Accepted-with-provenance format enforced). Docs-only.
Two D10-pattern acceptance packets submitted for Joshua's ruling:
- docs/audit/adr-0244-acceptance-packet-2026-07-17.md
- docs/audit/adr-0245-acceptance-packet-2026-07-17.md
Each is an evidence dossier (§1 claim→built→evidence→verdict table, §2 deviations,
§3 deferred, §4 gate results, §5 requested action). §8 RULING RECORD is PENDING and
both ADR status lines remain **Proposed** — the anti-self-Accept guard forbids me
flipping status without explicit ratification, so I have NOT.
The ADR-0244 packet §5 foregrounds the one caveat shaping the ruling: the identity
wave-gate is BUILT + VALIDATED but NOT live (identity_wave_gate=False; Phase-3
live-non-separation, best balanced error 0.346) — validated scaffolding pending
ADR-0246, not a live gate. The ADR-0245 §3 gate is complete (parity, f32 467×
speedup, 0-LAPACK, collision-resistance).
Plan doc Phase 6 → PACKETS DELIVERED, awaiting ratification. All build phases
(0-5) complete; the only remaining step is the human ratification gate.
[Verification]: Phase 5 gate green — smoke 176; fast lane 12032 passed / 25
skipped (core_rs built → Rust-parity + f32-speedup ran live). Docs-only commit;
both ADRs Proposed (provenance guard unaffected).
Close the two missing §3 acceptance legs. tests/test_adr_0245_acceptance_gate.py:
- ≥10× f32 speedup: the Rust core_rs.geometric_product f32 fast path vs the pure
Python kernel. Rust-guarded (skips with reason where core_rs is unbuilt);
includes a parity sanity check so the speedup can't come from skipped work.
Measured on Apple M-series this run: rust 2.86 us/op vs python 1340 us/op =
467× (assert a conservative ≥10× for CI timing robustness).
- _content_id collision-resistance: full 256-bit digest (len 64, not 16-hex),
type/structure-faithful (int≠str, bool≠int, nested-sensitive, key-order-
invariant), fails closed on non-serializable input (no default=str collapse);
_psi_digest full + sub-epsilon sensitive + deterministic.
- coverage manifest test maps all four §3 legs (parity f64/f32, 0-LAPACK-on-
repeat, f32 speedup, collision) to their home test files.
The other two legs (parity, 0-LAPACK) were already green; this makes the §3 gate
complete and legible. Test-only.
Verified: 6 new tests pass (speedup ran with a local core_rs build).
Full smoke + fast lane at Phase 5 close.
Pin the load-bearing §2.10 claim, not just the structure. The existing
test_adr_0242_fibonacci_word.py covers recurrence/length/sovereignty; §2.10's
actual promise is "reduce harmonic phase-locking," which comes from the Fibonacci
word's Sturmian properties. tests/test_adr_0244_scheduler_quasiperiodicity.py (32
cases) pins:
- golden-ratio letter density (count(A)=F_n, count(B)=F_{n-1}; A/B → φ) — a
maximally-irrational duty cycle resists resonance with periodic cadences;
- no harmonic clustering (no "BB", no "AAA") — neither action forms a locally
periodic burst;
- aperiodicity (no period p ≤ |W|/2) — genuinely quasi-periodic, not a disguised
periodic schedule.
A future refactor to a periodic schedule would pass the structure tests but fail
these. Audit-only; no production change (the module already satisfies the spec).
Verified: 32 new cases pass. Full smoke + fast lane at Phase 5 close.
The §2.9 low-discrepancy mode allocator concern is satisfied by construction, so
the deliverable is a proof, not a bolt-on wire. tests/test_adr_0244_mode_order_
independence.py (3 tests) pins:
- Recall (WaveManifold.compute_spectral_leakage) is a Gram least-squares
projection onto span(modes); projection onto a span is invariant to the order
of the spanning set. Verified: energy + residual identical across mode
insertion permutations to ~1e-15 (machine epsilon; nonzero-residual probe too).
- atlas_packing.golden_angle_pack places mode k at a deterministic golden-angle
coordinate from ordinal k alone (ALLOCATOR_VERSION reconstructible) — layout is
order-independent by construction; a prefix of a larger pack is the same modes.
Wiring the allocator into the durable content-seal path would be a category
mismatch (that path seals content versors at their own ψ, not allocator
positions). Test-only; no production change.
Verified: 3 new tests pass. Full smoke + fast lane at Phase 5 close.
Widen the residual contemplation/vault content-ids to full 256-bit digests and
remove the last default=str / bare-tobytes byte-order gaps (ADR-0244 §2.7 /
ADR-0245 §2.3). Content-addresses must not floor collision resistance or silently
collapse distinct payloads:
- core/contemplation/schema.py: _sha256_16 → _content_digest (full 64-hex);
finding_id + run_id no longer 16-hex truncated (was 2^32 birthday floor).
- core/contemplation/plan_preflight.py: _plan_substrate_hash full digest.
- core/contemplation/miners/articulation_quality.py: drop default=str (as_dict is
JSON-native — ints/str/python-float ratios/None — so a non-serializable field
now fails closed instead of str()-collapsing) + full digest.
- core/physics/holographic_vault.py: _default_mode_id full digest AND explicit
little-endian float64 coercion (was bare .tobytes() — implicit host endianness).
Content-addresses only; no persisted-id migration (old ids stay valid, new ones
widen). Tests assert determinism + content, not id length, so no cascade.
Verified: 334 contemplation/vault/miner tests pass (determinism + content intact).
Full smoke + fast lane run at Phase 5 close.
The single explicit, fail-closed f64→f32 down-cast at the certified lifecycle
egress. serving_cast(psi_steady, certificate, verdict) -> ServingState in
core/physics/cognitive_lifecycle.py:
- Casts ONLY a state that validates as a finite 32-vector, matches its
certificate psi_digest, and was verdict.admitted — an uncertified, refused, or
digest-mismatched state is never served.
- Precision-checks the f32 result (cast_error = max|f64-f32|, unit norm) and
fails closed on an f32 precision cliff (f32_precision_insufficient) rather than
serving a silently-degraded state.
- Keeps f64 as the source of truth: psi_steady and the psi_digest content-address
chain are untouched; ServingState carries provenance back (source_psi_digest,
certificate_id, measured cast_error) for audit. f64 stays inside
relaxation/eigendecomp — this is the one place f32 appears (ADR-0245 §2.2
mechanical sympathy).
Satisfies both ADR-0244 §2.5 and ADR-0245 §2.2 (one contract, two ADRs). Measured
on a real certified outcome: cast_error ~1.2e-8, unit_norm_f32 ~0.99999998.
Off-serving (A-04 guard: chat.runtime never imports it). ADR-0245 status map +
plan doc updated.
[Verification]: smoke 176 passed; fast lane 11907 passed / 109 skipped (-n auto,
not quarantine/slow); 10 targeted serving-cast tests passed.
D4 Phase 3 (§2.4). Calibrates the wave-gate leakage bound γ_id via the
bracketed-local Fibonacci section search and emits a content-addressed tuning
certificate (evals/adr_0244_gamma_calibration/). Two results, kept separate:
1. The search certifies γ* = 0.2126624458513829 (cert 0079b5f2…) separating
the geometric attack signal — in-subspace rotors admitted, axis→e4/e5
tilt/boost attacks flagged (inversions excluded: ~0-leakage, handled by the
orientation floor). Pinned as identity._WAVE_LEAKAGE_BOUND; the wave path is
decoupled from alignment_threshold (legacy path + hedge bands keep it).
2. The same bound does NOT separate real live traffic. Measured on the engine,
benign final_state.F versors do not preserve span(e1,e2,e3): leakage
0.14–0.81 (mean 0.55), self-align to −0.52, 12/13 benign false-refused at
γ*, best balanced error 0.346. The calibration certifies
flag_flip_authorized=False → identity_wave_gate stays OFF.
Root cause: the shipped value axes (truthfulness=e1, coherence=e2,
reverence=e3) are nominal basis vectors, not dynamically-preserved eigenmodes;
the field evolution gives the identity subspace no dynamical anchoring. The fix
is the ADR-0246 induced-identity-action programme (preflight brief merged). The
wave gate is validated, correctly-off scaffolding — not a live gate. A slow
drift-guard test canaries any future engine change that starts preserving
identity.
Off-serving (evals/ + tests); flag-off byte-identity preserved. ADR §4a +
plan doc + memory updated with the finding.
[Verification]: smoke 176 passed; fast lane 11897 passed / 109 skipped (-n
auto, not quarantine/slow); 59 targeted gate/calibration tests passed.
Lands docs/briefs/ADR-0246-induced-identity-action-and-path-integrity-preflight.md
(Shay 6e3ccd88, docs-only, +505) on top of main-with-full-Phase-2 (b440b92b).
The PR branched from c7e2b3b6 (pre-2c); this merge reconciles it with the
completed Phase 2 (2a 1c7ea26e / 2b c7e2b3b6 / 2c c0ff4720) so the post-D4
ADR-0246 planning baseline sits on the finished integrity floor. The brief
adds one new file under docs/briefs/ (no code, no ADR status flip, no
governance change) — verified read in full before merge; clean auto-merge
(no path overlap with Phase 2).
[Verification]: content verified (505-line docs-only planning brief, authored
by Shay, consistent with ADR-0244 §4a + D4 plan); merge adds only the brief
file; b440b92b already passed the full fast lane.
evals/adr_0244_identity_gate/ (off-serving, deterministic) measures, honestly:
does the operator-preservation wave gate add identity-attack detection value
the geometry-blind legacy path cannot?
Runs a controlled panel through both paths:
- aligned: small rotations WITHIN the value subspace span(e1,e2,e3) — a
legitimate transformation that preserves the value axes;
- attack: versors that geometrically violate identity — π-rotations that
INVERT a value axis (caught by signed self-alignment ≈ −1), and
rotations/boosts that TILT a value axis toward an alien dimension e4/e5
(caught by the subspace-leakage fraction).
Measured result (pinned by tests/test_adr_0244_identity_gate_eval.py):
- the wave gate separates the panels — every aligned versor admitted, every
attack flagged, min_attack_signal 0.35 > max_aligned_leakage 0.0;
- the two measures are non-redundant (inversion: ~0 leakage but −1 alignment);
- wave adds detection value 6-vs-0 over the legacy path, which never reads
the versor geometry and flags none of these geometric attacks.
Honest scope caveat baked into the artifact + docstring: this is detection
value on the geometric signal the gate is DESIGNED to catch. Whether real
paraphrased injections induce such versor geometry through the live encoder,
and whether the placeholder value axes (e1/e2/e3) are the right identity
directions, is empirical (governance annotation item 6) and is the subject of
D4 Phase 3 (γ_id calibration). The flag stays OFF until that is evidenced.
6 tests + CLI (exit 0 iff separates AND adds detection value).
[Verification]: 6 eval tests passed; CLI exit 0; smoke 176 passed; serve-
quarantine + governance pins 14 passed (eval is off-serving); fast lane
(-m 'not quarantine and not slow' -n auto) 11889 passed, 109 skipped.
Additive-only (new evals/ package + test); no core/chat/algebra changes.
Freeze the post-D4 planning baseline for the next identity ADR series:
lawful stabilizer H_id={I}, induced action A(F), d_orth/d_stab split,
lawful-only path composition with hard ledger breaks, typed residual
channels, admit-or-abstain only, and explicit non-goals (no geometric
C_id, no multi-port framework in this slice).
Implementation starts only after D4 Phase 6 (or explicit waiver). Does
not expand or interrupt the live ADR-0244 D4 arc.
[Verification]: Smoke suite passed locally (314s, 176 passed)
Wires the ADR-0244 §2.2 wave gate into the live turn loop behind a new
opt-in flag, byte-identical when off, plus a normalization fix found in
integration.
core/config.py: RuntimeConfig.identity_wave_gate (bool = False). OFF by
default — the leakage threshold is provisional (reuses alignment_threshold)
until calibrated to gamma_id in Phase 3, and flag-off is byte-identical to
the pre-ADR-0244 advisory path.
chat/runtime.py (main chat() path, two flag-gated touches):
- at the identity check, pass wave_field=result.final_state.F when the
flag is on (so hedging + telemetry both use the wave score); None when
off -> legacy scalar-L2 path.
- after the safety/ethics verdicts exist, intersect their violated
boundaries with the manifold's committed boundary_ids (supplement via
dataclasses.replace) and fold a fail-closed geometric IdentityGateRefusal
into the typed refusal surface (TYPED_REFUSAL_PREFIX). refusal_emitted is
derived once, after the block, preserving the (surface is not None) <=>
emitted invariant.
chat/telemetry.py: serialize_turn_event emits the wave-gate keys
(identity_wave_mode / _leakage_norm / _min_self_alignment /
_boundary_violations) only when identity_score.wave_mode_active — so the
wire format is byte-identical when the gate is off.
core/physics/identity_manifold.py — NORMALIZATION FIX (found in
integration): the live versor carries boost (e5) components, and a boost is
a unit versor (R R~ = 1) that does NOT preserve the Euclidean coefficient
norm, so ‖R a_i R~‖ > 1 and the un-normalized leakage/self-alignment ran
past their ranges (measured leakage 5.16, self_align -4.75 on a real turn).
axis_response now normalizes each measure by the rotated-axis magnitude:
leakage is a fraction in [0,1], self_align a signed cosine in [-1,1]. For a
norm-preserving spatial rotor the rotated axis is unit and normalization is
a no-op (Phase 1 results unchanged). §4a updated to match; new boost test
pins bounded measures.
tests/test_adr_0244_identity_gate_runtime.py (new): flag OFF -> legacy
score + no wave telemetry (byte-identical wire); flag ON -> wave gate active
on the live versor + wave telemetry present + bounded measures; flag-off
determinism. Seeds a short sequence to reach main-path (identity-checked)
turns (a fresh empty-vault runtime routes ungrounded inputs to disclosure).
[Verification]: 74 targeted (manifold+gate+runtime+legacy identity+
telemetry) passed; in-worktree smoke 176 passed; fast lane
(-m 'not quarantine and not slow' -n auto) 11883 passed, 109 skipped —
flag-off byte-identity confirmed across the whole suite.
Extends core/physics/identity.py with the ADR-0244 §2.2/§4a wave-field gate
as a pure, dual-mode capability (no runtime behavior change — the legacy
path stays byte-identical when no wave field is supplied).
- check(trajectory, manifold, *, wave_field=None, violated_boundary_ids=
frozenset()): dual-mode. wave_field present -> operator-preservation
gate; absent -> legacy scalar-L2 (ADR-0010). A MALFORMED wave field
(non-finite / wrong shape / wrong byte-order) raises a typed ValueError
via _validate_wave_field — it never silently falls back to legacy (the
dual-mode fallback is for an ABSENT wave field only).
- _wave_field_score: operator-preservation via IdentityManifoldGeometry
(Phase 1). The trajectory is a versor (operator), so we measure whether
it PRESERVES the value subspace: RMS subspace leakage (tilt toward alien
dimensions) + signed self-alignment (in-subspace inversion). score =
1 - leakage_rms; flagged on score<threshold OR inversion OR boundary.
- IdentityScore extended (wave_mode_active, leakage_norm,
min_self_alignment, boundary_violations) — all defaulted, legacy shape
and construction preserved.
- boundary_ids predicate: violated_boundary_ids & manifold.boundary_ids;
a non-empty intersection is a hard identity-boundary breach (activates
the previously-dormant boundary_ids; item 7).
- IdentityGateRefusal + conjugate_correct (C_id): v1 admit-or-abstain, NO
silent correction of the versor (honors the safety-pack
no_silent_correction boundary); abstains (raises) on violation.
- would_violate extended for boundary + inversion (legacy defaults never
trigger the new branches).
identity_manifold is now imported by identity.py (serve-safe pure algebra);
serve-quarantine transitive test stays green.
tests/test_adr_0244_identity_gate_wave.py (16 tests): dual-mode dispatch,
identity-versor alignment, alien-dimension tilt leakage, in-subspace
inversion caught via orientation, fail-closed malformed validation, the
boundary intersection predicate (in/out of manifold, legacy path too),
C_id admit-or-abstain, would_violate extensions, legacy back-compat,
determinism.
[Verification]: 16 new tests passed; legacy identity + quarantine +
telemetry-fanout suite 54 passed (legacy behavior + serve-quarantine
preserved); in-worktree smoke 176 passed; fast lane (-m 'not quarantine
and not slow' -n auto) 11879 passed, 109 skipped.
Implements ADR-0244 §2.1/§4a: the metric-exact operator-preservation
geometry, pure and off-serve (wired into the runtime gate in Phase 2).
core/physics/identity_manifold.py:
- lift_axis: R^3 pack direction -> grade-1 Cl(4,1) at e1/e2/e3 slots
(basis_vector, not embed_point) so the value subspace lives in the
spatial grade-1 block where <.,.>_0 = Euclidean and the Gram matrix
is positive-definite.
- gram_matrix + ManifoldConditioningError (fail closed when cond(G)>1e5).
- subspace_project: metric-orthogonal P_I(x) with SIGNED coefficients.
- sandwich: versor action R x R~.
- euclidean_norm: positive-definite leakage magnitude (NOT the indefinite
Cl(4,1) norm, which can vanish/negate an e5-boost leakage).
- IdentityManifoldGeometry (frozen): axes_psi + Gram + Gram^-1; .project,
.axis_response -> (leakage, self_align), .leakage_rms.
Operator-preservation, per the ratified core-mechanism correction: the
live trajectory final_state.F is a VERSOR (even-grade operator, zero
grade-1 content), so we measure whether it PRESERVES the value subspace
via F a_i F~, not whether it lives in it. Two per-axis measures, both
required and non-redundant:
- subspace leakage euclidean_norm(rot_i - P_I(rot_i)) catches tilt of a
value axis toward an alien dimension (e4/e5);
- signed self-alignment <a_i, rot_i>_0 catches in-subspace inversion
(e1 -> -e1: leakage 0 but self-align -1).
tests/test_adr_0244_identity_manifold.py (24 tests) pins every falsifiable
claim: G=I for the default pack, idempotent projection, identity versor ->
0 leakage/+1 align, within-plane rotation -> no leak, e4/e5 tilt -> leak,
pi-inversion -> 0 leak but -1 self-align, near-degenerate axes ->
ManifoldConditioningError, determinism.
[Verification]: 24 new tests passed; in-worktree smoke 176 passed; fast
lane (-m 'not quarantine and not slow' -n auto) 11863 passed, 109 skipped;
serve-quarantine transitive test 2 passed (new module is NOT dragged onto
the serve path — off-serve until Phase 2).
Discovered before implementing Phase 1: the live identity trajectory
final_state.F carries the invariant versor_condition(F) < 1e-6 — it is a
VERSOR (even-grade operator, grades 0/2/4, exactly zero grade-1 content).
§2.1/§2.2's literal 'project psi_traj onto the grade-1 value subspace' is
therefore VACUOUS on the real runtime object: P_id(F) = 0 identically,
flagging every trajectory — a fail-closed brick. Root cause: a versor is
an operator, not a state vector; projecting the operator into a subspace
of states is a category error.
Resolution (ratified by Joshua Shay 2026-07-17): measure whether the
versor PRESERVES the value subspace, via its action on the axes
F a_i F~ (sandwich). Two per-axis measures, both empirically verified
necessary and non-redundant:
- subspace leakage = euclidean_norm(rot_i - P_I(rot_i)) — catches a
versor tilting a value axis toward an alien dimension (e4/e5);
- signed self-alignment = <a_i, rot_i>_0 — catches in-subspace
inversion (e1 -> -e1: leakage 0 but self-align -1), the concrete
realization of the ratified 'signed overlap, never abs()' decision.
Keeps the grade-1 pack axes unchanged (no pack migration) and sharpens
inalienability: identity is invariant UNDER transformation, not a frozen
state.
§4a rewritten to the operator-preservation spec (lift_axis, gram_matrix,
subspace_project, sandwich, euclidean_norm, axis_response); governance
annotation item 12 records the reframe + ratification; plan doc §3 Fact C
+ §5 Phase 1 + progress log updated.
[Verification]: docs-only ADR/plan amendment; provenance/ADR guard
(test_adr_0241_governance_p12.py) 6 passed — ADR-0244 Status line
confirmed still 'Proposed' (the item-12 ratification text is inside the
annotation/§4a, not a status flip). All acceptance numbers pre-verified
via in-tree numerical probes against algebra.cl41.
Reconciles ADR-0244 against its own D0 blockers and commits ADR-0245 as
a real companion ADR (previously a dangling reference in ADR-0244 §4).
ADR-0244 governance annotation expanded (11 items, all body text below
preserved verbatim for R&D provenance; annotation governs on conflict):
1. Q_top proof (already landed) now explicitly drops the §2.2 egress
ΔQ_top conjunct (it is a hollow, always-true discriminator).
2. §4-vs-§2 contradiction RESOLVED — new §4a is the governing spec;
§4 kept verbatim as the (contradictory) original R&D sketch.
3. §2.1 axis construction was underspecified (packs ship dim-3
directions, not 32-vectors) — resolved via a grade-1 lift at the
e1/e2/e3 slots (algebra.cl41.basis_vector), not embed_point.
4. §2.2 amended: signed overlap (never abs()'d — anti-alignment must
stay distinguishable from orthogonality); leakage norm is the
positive-definite Euclidean coefficient norm, not the indefinite
Cl(4,1) inner product (which (+,+,+,+,-) permits to vanish for
nonzero leakage).
5. Inalienability reframed as 5 testable layers (algebraic / runtime
/ pipeline / operational / semantic) — only the first is a math
guarantee.
6. Paraphrase-invariance reworded as an empirical, measured property;
Q_top conservation scoped to pure versors only (relax_to_ground
can converge to non-versor superpositions — the ADR-0243 SD-A
subtlety).
7. boundary_ids activation (currently stored, never evaluated).
8. Identity manifold is FROZEN — biography holonomy accumulates
separately and never mutates the identity subspace.
9-11. Filename correction (multimodal_lifecycle.py doesn't exist;
real file is cognitive_lifecycle.py), ADR-0245 cross-link,
theological citation labeled ESV + analogy disclaimer.
New §4a supersedes §4 with a typed, Gram/leakage-correct specification
(ManifoldConditioningError, IdentityGateRefusal, bounded/abstaining
C_id, isfinite + shape guards — no bare assert) for Phase 1/2 to build
against under TDD.
ADR-0245 committed Proposed, verbatim from the R&D export, with a
governance annotation mapping its 4 decisions + Sec 3 acceptance gate
against what the cohesion-directive arc already landed (Rust f32 GP,
_cached_eigh, digest hot-path all done; f64->f32 cast + Sec 3's
speedup/collision proofs open — tracked as D4 Phase 4/5).
Audit doc (adr-0244-cohesion-directive-audit-2026-07-17.md) wrinkles
1-2 and Q5 sequencing updated from 'pending'/'must reconcile' to
resolved, cross-referencing this landing.
[Verification]: in-worktree smoke gate 176 passed; provenance/ADR
governance pins (test_adr_0241_governance_p12.py,
test_adr_0242_topological_quarantine.py, test_third_door_cohesion.py)
30 passed — confirms ADR-0244 stays Proposed (no status flip) and no
existing ADR provenance guard was disturbed. Docs-only change, no
executable surface touched.
Comprehensive phased plan for full ADR-0244 realization (D4) plus the
ADR-0245 companion: locked design decisions (Q_top dropped from egress,
grade-1 axis lift, signed overlap, Euclidean leakage norm, frozen
identity manifold, bounded/abstaining C_id), code-verified ground truth
(Fact A dim-3 axes, Fact B two field surfaces, boundary_ids dormant),
folded-in external-review considerations, and a per-phase progress
dashboard for seamless cross-session resume after rate-limit breaks.
[Verification]: docs-only (docs/handoff/), no executable surface; smoke
deferred to Phase 0 (first phase touching governance/ADR tests).
Turns the D0 "likely vacuous" annotation on ADR-0244 §2.3 into a re-runnable proof
that ΔQ_top = 0 is a hollow egress gate (the #19-pseudoscalar failure mode).
evals/adr_0244_qtop_vacuity/ — computes Q_top = <psi I5 ~psi>_0 on the real
Cl(4,1) algebra and finds: (1) Q_top = 0.000e+00 EXACTLY across every unit versor
(spatial rotors AND boosts through e5, and products) — I5 is central so
psi I5 ~psi = I5*(psi ~psi) = I5 for a unit versor, scalar part 0; (2) off the
versor manifold Q_top = -grade5(psi ~psi), nonzero only where the I-05 closure
residual already fires; (3) it is a conserved Spin(4,1) invariant but identically
0 on the valid manifold; (4) the decisive test — an aligned identity and an
adversarially-rotated one (a valid versor, overlap 0.963) both read Q_top = 0, so
ΔQ_top = 0 PASSES the attack the spectral-leakage/closure check actually catches.
Typed JSON artifact + CLI (exit 0 iff proven_vacuous).
tests/test_adr_0244_qtop_vacuity.py — pins each step + off-serving quarantine.
Docs: ADR-0244 §2.3 annotation upgraded "likely vacuous" -> "PROVEN vacuous —
retire from egress"; audit-doc Q4 marked RESOLVED with the evidence.
Verdict: do NOT wire ΔQ_top = 0 as an egress admit condition; keep Q_top, if at
all, as a closure-derived diagnostic. Closes the first of the two ADR-0244 D4
blockers with proof.
[Verification]: qtop eval 8 tests green; CLI proven_vacuous=true; smoke below.
Cohesion directive Mandate 6 (ADR-0244 §2.4). The Fibonacci search was already
~85% compliant (typed OptimizationFailure, fail-closed, bracketed contract,
never a bare float); this closes the two residuals honestly:
- Rename the failure reason unimodality_violation_multiple_extrema_detected ->
sampled_unimodality_violation_observed. A finite sample cannot prove global
unimodality; the check only *observes* a violation on the evaluated points.
Docstrings now state the Bracketed-Local contract explicitly.
- propose_kappa_from_search: kappa=1.0-on-failure IS the required "parameters
unchanged" no-op (thr = productive_threshold / 1.0), and the typed
OptimizationFailure is already returned as the second element — so the fix is
legibility, not a behavior change (the working seam is preserved, not broken):
the docstring names baseline as an explicit caller-side policy, and a new test
pins that a failed search surfaces the typed failure rather than a bare float.
tests: test_adr_0244_search_honesty pins the renamed reason end-to-end (a
cos(8*pi*x) objective whose golden-section samples are non-monotone triggers it;
a smooth bimodal instead converges to a local-min certificate — the honest
Bracketed-Local distinction), _unimodality_ok as a finite-sample check, kappa
failure legibility + no-op baseline, and that no stale reason string remains.
[Verification]: search-honesty 6 + adr_0242_fibonacci + third_door_cohesion +
carry_seams green; smoke + fast lane below.
Cohesion directive Mandates 1+2 (ADR-0244 §2.6 / §2.8).
Mandate 1 — Rust f64 geometric_product fast-path:
- core-rs/src/lib.rs: export a geometric_product_f64 PyO3 wrapper (mirrors the
f32 one; delegates to cl41::geometric_product_f64, itself a term-for-term
mirror of the pure-Python f64 kernel — same i-major scatter order, no FMA).
- algebra/backend.py: f64 branch in geometric_product, gated on CORE_BACKEND=rust
+ core_rs present (default stays pure-Python; older builds fall through on
AttributeError). The directive's f32 gate was already built; the real gap was f64.
- Contract is BIT-IDENTICAL, not tol-matched: a 1-ULP divergence would move the
f64 wave-field residual bytes and break I-02 replay under CORE_BACKEND=rust.
Verified: test_geometric_product_f64_parity N=10000 Rust-vs-Python bit-for-bit
+ CORE_BACKEND=rust subprocess hex match (core_rs built).
- Measured M1 speedup (sixth acceptance criterion): dense f64 GP ~120x
(Rust 4.3 us/call vs Python 520 us/call) with parity holding.
Mandate 2 — eigh memoization:
- cognitive_lifecycle.py: relax_to_ground's dense-branch np.linalg.eigh routed
through _cached_eigh (functools.lru_cache, keyed on the frozen hamiltonian_id +
matrix bytes), returning frozen read-only (evals, evecs) so a cache hit can
never be mutated — every hit is bit-identical. The diagonal (propositional)
fast path is untouched.
tests: test_adr_0244_mechanical_sympathy pins cached-eigh == fresh eigh,
read-only arrays, hit-returns-identical-objects, and relaxation determinism
through the cache; D9 extended with the N=10000 bit-identity gate and its
now-stale "f64 is Python-only" pins updated.
[Verification]: D9 22 passed (incl. bit-identity N=10000, core_rs built) +
mechanical-sympathy + cognitive_lifecycle green; smoke + fast lane below.
Cohesion directive Mandates 4+5. The ADR-0243 lifecycle modules were the only
content-address sites still truncating SHA-256 to 96 bits (24 hex) and passing
default=str to json.dumps — the rest of the codebase already uses full 64-hex
digests (claim_digest, cert_id, decision_id, pressure_id, ...). The default=str
+ [:24] drift had also just replicated into Lane C (biography_wiring.py).
- cognitive_lifecycle.py: _content_id drops default=str (non-serializable payload
now fails closed with TypeError) + full 64-hex; _psi_digest full 64-hex over
canonical little-endian f64 bytes via a new _le_f64_bytes helper (coercion, not
the assert form the ADR-0244 draft used — assert is stripped under -O);
matrix_sha routed through _le_f64_bytes too.
- biography_wiring.py, self_authorship.py: same _content_id hardening. Verified
every payload is JSON-safe after the existing float()/str() wrapping, so
removing default=str changes no current digest value — only future
non-serializable inputs fail closed.
- On little-endian targets the widening is an un-truncation: the new 64-hex
digest's 24-char prefix equals the old value (pinned).
tests: test_adr_0243_cognitive_lifecycle psi_digest gold updated to full+LE; new
test_adr_0244_semantic_rigor pins full-64 length, fail-closed TypeError, LE
byte-order canonicality (native vs >f8 hash-equal), and determinism.
[Verification]: D1-affected suites 66 + miner suites 23 green; smoke + fast lane below.
First step of the cohesion-directive arc (docs only; no code).
- docs/adr/ADR-0244-…md: committed Proposed, verbatim from the R&D export
(matching the ADR-0241/2/3 landing convention), plus a clearly-marked
governance annotation holding two items open for the D4 implementation plan:
(1) §2.3 Q_top is likely vacuous — central I5 in odd Cl(4,1) collapses the
charge on versor states (the #19 pseudoscalar failure mode); it must not be an
egress gate without an empirical discriminating counterexample; (2) §4's
conformed implementation contradicts §2.1-2.2 (per-axis resonance vs.
Gram-projection/leakage-norm/ManifoldConditioningError), references a dangling
ADR-0245, and uses a bare assert for the byte-order guard.
- docs/analysis/engineering_cohesion_refactoring_directive.md: the technical
directive moved to its own canonical path, verbatim (content byte-identical).
- docs/analysis/adr-0244-cohesion-directive-audit-2026-07-17.md: the code-level
audit of all 7 mandates vs. main@24078b11 — per-mandate verdicts, the six
spec-level wrinkles, the amended mandate→work-item mapping, the missing sixth
acceptance criterion (Mechanical-Sympathy gain), and the five decisions (Q1-Q5).
Notable finding: the default=str + 24-char-digest drift the directive flags was
replicated into Lane C (biography_wiring.py) AFTER the directive was written —
raising the priority of the D1 semantic-rigor batch.
[Verification]: docs-only; ADR governance provenance-guard green (unchanged).
Submits the ADR-0243 arc for Joshua's ruling: claims-vs-evidence, deviations
D-1..D-5, deferred items, and the arc gate results (Phase 4 fast lane 11808;
decisive falsifier wrong==0). Follows the ADR-0241/0242 packet convention.
The Proposed->Accepted flip is NOT made here: the anti-self-Accept guard
(test_adr_0241_governance_p12) requires a recorded human ruling with inline
provenance. Section 8 RULING RECORD is PENDING; the status flip is a separate
one-line governance commit carrying Joshua's ratification, made only after his
explicit ruling.
[Verification]: docs-only; ADR-0243 suite + provenance-guard green.
Completes ADR-0243 Phase 4 (plan §5). Adds the metrics benchmark scoring the
cognitive lifecycle against concrete falsifiable comparison classes, joining the
already-committed decisive propositional falsifier (bdf8146a) under one eval package.
evals/adr_0243_cognitive_lifecycle/benchmark.py — five falsifiable metrics, each
grounded in a live lifecycle primitive (no decorative numbers); typed
BenchmarkVerdict / MetricResult; deterministic, JSON-safe:
- fidelity: decode overlap |<psi_steady, target>| after relax_to_ground on a
quadratic well from a perturbed start (min >= 0.999; measured 1.0).
- surprise separation: energy-above-ground of ID (small rotations of the
identity axis) vs OOD (near-orthogonal rotations into distinct Cl(4,1)
planes) against a fixed identity well; strict margined separation
min_ood - max_id > 0.05 (measured 0.834); lam0 verified ~0, not assumed.
- insertion cost: relaxation certificate.steps_taken — all certified, bounded
(<= 256), real work (max_steps > 0; measured 22-23).
- f32 drift over T=1000: unit versor iterated by a fixed rotor with no renorm;
f64 holds versor closure to 1e-9 (~8e-14 measured) while f32 truncates to
~4.7e-5 (ratio ~5.9e8) — the gap motivating ADR-0244 §2.5/§2.6.
- falsifier: run_propositional_falsifier wrong == 0 (1008 ID + 18 refusal-parity).
evals/adr_0243_cognitive_lifecycle/__main__.py — subcommand dispatcher
(benchmark [default] / corridor / falsifier); non-zero exit on falsification.
tests/test_adr_0243_benchmark.py — pins overall pass, each metric's falsifiable
claim, the genuine f32/f64 drift gap, CLI routing + exit codes, and the A-04
off-serving quarantine.
[Verification]: in-worktree smoke gate 176 passed; fast lane
(-m "not quarantine and not slow" -n auto) 11808 passed, 108 skipped;
serve-quarantine + third-door cohesion + dispatch hygiene 22 passed; Phase 4
tests (benchmark + falsifier) 17 passed; benchmark overall_passed True
(deterministic across runs).
The propositional slice of ADR-0243's falsifiability benchmark (plan §5 Phase 4),
the arc's load-bearing evidence. Two mechanism-disjoint engines decide the SAME
enumerated propositional problems:
- Field decoder: propositional_entails (Cl(4,1) wave-field ground energy).
- Gold: generate.proof_chain.entail.evaluate_entailment (exact ROBDD tautology
check, ADR-0201 keystone) — genuinely independent, not the field checking itself.
A clause→string bridge (render_clause: `a | ~b | c`) lets both engines decide
byte-for-byte the same problem. Result over the enumerated panel (atoms a,b,c;
premise sets size ≤2):
- 1008 satisfiable-premise ID comparisons: field.entailed ⇔ gold is ENTAILED —
wrong == 0.
- 18 inconsistent-premise cases: field discloses satisfiable_premises=False
exactly where gold returns REFUSED — matched refusal, no ex-falso leak.
- OOD (>5 atoms): field decoder refuses by construction while gold still decides
— the honest ID/OOD scope boundary in the propositional domain.
Deterministic (enumerated, no randomness/wall-clock); off-serving (evals/ only,
chat/runtime non-import pinned).
[Verification]: tests/test_adr_0243_propositional_falsifier.py — 6 passed;
run_propositional_falsifier() → wrong=0 over 1026 field-vs-gold decisions.
Wire the ADR-0242 §5 pinned primitives into the contemplation runner
(ADR-0243 §2.4): contemplate_surprise_history() gates the newest
caller-timed ADR-0239 dual-operator observation through
is_discovery_eligible, the measured history through
cross_band_discovery_gate (F5/F6/F7 persistence), and only then emits a
DiscoveryCandidate via the existing emit_surprise_discovery ->
DiscoveryCandidateSink. Proposal-plumbing only: the sole side effect is
sink.emit().
Surprise-signal sourcing (the Lane A open question): ContemplationFinding
carries no surprise measurement and the report-mining paths have no
geometry, so nothing is fabricated for them — the canonical carrier is
the ADR-0239 dual audit dict (SelfAuthorshipMiner / ADR-0240 harness),
consumed as explicit SurpriseObservations with caller-supplied logical
time (deterministic, no wall clock).
Give propose_kappa_line_search its live caller (ADR-0242 §5-P1):
evals/analogical_transfer/kappa_calibration.py calibrate_transfer_kappa,
confined to the ADR-0240 calibration pipeline per R-04; kappa_search_event
fires exactly once when a sink is passed. Proposal-only — no
GoldTetherMonitor mutation.
A-04 hardening found during review: chat/runtime.py idle_tick lazily
imports core.contemplation.runner inside the serve process, and the
package __init__ eagerly pulled wave_seam -> holographic_vault (a
serve-banned module) — a PRE-EXISTING process-level quarantine breach.
Closed by making the wave-seam re-exports lazy (PEP 562) and keeping the
multi_scale_energy gate import function-local; pinned by a new dynamic
idle-tick-edge test in test_serve_quarantine_transitive.py.
Pinned primitives untouched: is_discovery_eligible,
cross_band_discovery_gate, candidate_from_surprise_dual signatures
unchanged; no changes to cognitive_lifecycle.py or chat/runtime.py.
New evals/adr_0243_cognitive_lifecycle/ composes AudioCompiler/VisionCompiler ->
sensorium_wave_feed -> relax_to_ground/CognitiveLifecycleEngine.egress ->
generate/realizer readback -> explicit GoldTetherMonitor.decide into one
deterministic fixed-replay corridor, per
docs/handoff/ADR-0243-PHASE3-BRIEF-PACK.md Brief B. Pure composition of
already-tested organs; no new core.physics module; OFF-SERVING (evals/ only,
never imported by chat/runtime.py).
Relaxation targets the full audio+vision integrated percept but starts from the
audio-only partial percept (engine.solve() is not used, since it ties start ==
target) so the relaxer decodes across real steps rather than starting
already-converged; stages are driven explicitly and reassembled into one
LifecycleOutcome keyed off the full percept.
[Verification]: uv run core test --suite smoke -q (176 passed); sensorium suite
(152 passed); algebra suite (82 passed, 50 skipped); new
tests/test_adr_0243_sensorium_corridor.py (6 passed, includes a
steps_taken > 0 pin against silent regression to a no-op relax, a cosine/ANN-free
static pin, and a chat/runtime.py non-import pin).
First live caller of integrate_biography (previously zero production call
sites). New core/physics/biography_wiring.py: report-level PASS gate
(report.wrong == 0 AND >=1 correct transfer; refusals don't block but
all-refused validates nothing), I-01 closure asserts re-checked at the
wiring seam (fail-closed typed BiographyIntegrationError), and a net-new
append-only BiographyProvenanceRecord binding report evidence to the
integrated trajectory hash (AuthorshipProposal-style closure proof in a
TurnEvent-style audit role).
Design ruling (Shay, 2026-07-17, brief open question): direct integration,
structurally pinned — integrate_biography is a pure recompute
(reconstruction-over-storage), so D-5/I-03 proposal gating does not attach;
the ruling is enforced by a test pinning that the wiring imports no vault
store and no evals package (report typed structurally, no core->evals
import). Module registered in the never-serve lazy tier + _BANNED +
third-door banned lists. cognitive_lifecycle.py untouched (Lane C touches
zero Phase-2 code).
Phase 2 merged (#56) after the brief pack was written; feat/adr-0243-phase2-lifecycle
no longer exists. Lane B's base/worktree instructions pointed at it. All three
lanes now branch off forgejo/main directly, per the actual current state.
Orthogonal docs-only fix, direct push (no code/tests touched).
