Phase 2.3: the first inference rule + the wrong=0 mechanism for proofs.
- generate/proof_chain/rules.py: evaluate_modus_ponens / evaluate_proof_conclusion.
Proof-layer dispatch (Option B) over proposition FORMULAS via the canonicalizer;
never touches check_admissibility/_resolve_dep_units (proofs have no units).
Disagreement rule = the select_self_verified twin: pool ALL admissible single-step
MP derivations, require a unique canonical key == declared conclusion. Pooling (not
filter-to-declared-first) is the soundness mechanism.
- generate/logic_canonical.py: parse_top_implication (+ _unparse) — recovers an
implication's syntactic antecedent/consequent (the ROBDD form doesn't preserve it).
- Closed typed-reason set; the corpus's finer labels consolidate (6 disagreement
refuse-labels -> conclusion_disagreement; 4 antecedent-flavor labels ->
unestablished_antecedent — same redundancy, same mechanism-makes-one-distinction
principle).
- Honesty boundary (exact scope): guarantees a unique conclusion among SINGLE-STEP MP
over the premises, NOT "uniquely entailed" by all strategies.
Cross-check: all 24 GPT-5.5 adversarial corpus cases agree on OUTCOME against the real
rule (no rule bug / no corpus outcome-misread); reasons consolidate as above.
Mutation: filter-to-declared-first makes DISAGREE-007/010 wrongly admit -> pooling
tests fail (pooling load-bearing).
Drive-by fix (cleanup-as-you-find): merged ADR-0204 ProofNode.__post_init__ was
dedented to module level -> all ProofNode validation was silently DEAD (smoke skips
the dedicated test file; the smoke != full-suite hazard). Re-indented; validation
restored.
Additive (math lane untouched). Full binding-graph surface green; smoke 67.
Phase 2.2, structure only (no inference rule — modus_ponens is 2.3). Translates a
Proof into a SemanticSymbolicBindingGraph; the ADR-0203 acyclicity guard + ADR-0132
referential integrity fire at construction.
- generate/proof_chain/model.py: the one canonical proof input shape (ProofNode/Proof
+ proof_from_premises desugaring of the corpus premises/conclusion shape).
- generate/proof_chain/builder.py: build_proof_graph — node→symbol+equation;
canonical_key→rhs_canonical, depends_on→dependencies, rule→operation_kind;
premises = empty-deps/op="premise"; unit_proof=PROOF_NO_UNIT, admissibility="pending";
conclusion tracked as conclusion_symbol_id.
- tests: 9 — valid DAG (PC-MP-001 desugared) + multistep construct; PC-CYCLE-001
refuses THROUGH the real builder (circular_dependency); canonical_key round-trips
byte-identical + equivalent formulas share rhs_canonical; admissibility-dispatch
confirmation; self/dangling refusals; out-of-regime node refuses. Mutation-verified
(drop dep-wiring -> cycle admitted -> test fails).
Admissibility dispatch confirmed graceful on proof operation_kinds: unknown kinds
-> AdmissibilityError(unknown_operation), unitless deps -> unit_unbound; NEVER
misroutes into _check_additive. Named 2.3 constraint: check_admissibility runs
_resolve_dep_units before dispatch, so modus_ponens must bypass unit-resolution.
Open items named for 2.3 (ADR-0204): conclusion typing (BoundUnknown revisit),
semantic_role="unknown" (closed vocab has no "proposition"), unit_proof sentinel.
Additive (first consumer; math lane untouched). Full binding-graph surface green;
smoke 67. Honesty boundary: through 2.3, sound over declared atoms, not grounded in input.
GPT-5.5's independent corpus caught that the canonicalizer refused quantified/
predicate input only by accident (tokenizer chokes on '.'), not by design — a
by-luck-not-by-design refusal the wrong=0 discipline rejects. ADR-0202 §3 names a
typed `out_of_decidable_regime` refusal; the keystone emitted a generic grammar error.
- logic_canonical.py: LogicRegimeError(LogicError) + OUT_OF_DECIDABLE_REGIME;
_reject_out_of_regime_text (quantifier words forall/exists + symbols ∀/∃, pre-scan)
and _reject_out_of_regime_tokens (predicate-application ATOM-then-LPAREN), run BEFORE
the generic grammar error. Refusal only — no predicate/FOL capability added.
- logic_equivalence.py: typed regime branch (before the generic LogicError branch).
- tests: 43 total (10 new) — OOR refuses with typed reason; equivalence path too;
genuine grammar errors stay plain LogicError (no over-fire); `not (P)` not mistaken
for predicate application. Mutation-verified by-design (neuter -> falls through to
generic grammar error).
- ADR-0201.1: additive sub-ADR of 0201 (not an amendment; sub-number preserves the
landed ADR-0203 forward refs + phase-2 plan numbering). Honesty boundary load-bearing.
Corpus now 22/22 (PC-OOR-001/002 agree on the principled reason). Full canonicalizer
suite green; smoke 67 passed. modus_ponens rule-reasons remain deferred to ADR-0205 (2.3).
proof_chain phase 2.1: the acyclicity guard at the shared binding-graph
construction boundary, before phase 2.2 wiring can build a cyclic-capable structure.
- generate/binding_graph/acyclicity.py: pure find_cycle(adjacency) detector
(deterministic three-colour DFS; isolated, no model import).
- model.py __post_init__: builds {lhs: deps} adjacency over equations and raises
BindingGraphError(circular_dependency ...) on a cycle. Runs on every binding
graph (math + future proof) — illegal states unrepresentable for all consumers.
- tests/test_binding_graph_acyclicity.py: 17 tests (pure checker + construction
enforcement); mutation-verified non-vacuous.
- ADR-0203: new ADDITIVE invariant referencing ADR-0132 (not an amendment —
preserves the why-added-later history).
Math-lane regression proof: the only producer (math adapter) is acyclic by
construction (fresh result symbol per op, deps point backward); full
binding-graph + admissibility surface 392 green; guard refuses no existing graph.
Honesty boundary (load-bearing): through phase 2.3, proof_chain is SOUND OVER
DECLARED ATOMS, not grounded in recognized input (grounding is phase 2.4).
full binding-graph/admissibility surface: 392 passed. smoke: 67 passed.
1-page exec + backing brief for a first technical conversation, written to
survive a skeptical CTO. Every number/status sourced to docs/claims_ledger.md;
substrate-beneath-BrainOS framing held (not perception/motor); verify block is
fresh-clone-green. Prepared for internal review — not for distribution.
Reconcile every artifact that asserted the (since auto-reverted) mathematics_logic
expert promotion to the live machine state. Determinism proven intact (Week-1a):
the digest divergence is genuine single-source evidence-drift (GSM8K coverage probe
3/47 -> 4/46 via #310/#488), not a non-determinism defect. ADR-0120's fail-closed
property fired as designed; CORE revoked its own expert claim.
History keeps receipts; current-state reconciles to truth:
- Regenerate expert_claims_math_v1_signed.json -> promote_admitted:false,
reviewer_signature_matches:false, digest 02f6d3c8.
- reviewers.yaml math_expert_claims: quarantine note; entry kept (mismatch-refusal
keeps firing); intentionally NOT re-signed.
- ADR-0120-math-expert-ledger-flip: dated valid-at/auto-reverted header note.
- README: "next gate" narrative -> built-attempted-reverted; refresh stale count.
- docs/decisions/README: revert note + ADR-0200 index row.
- 3 fail-closed tests (2 files): "is-expert" -> fail-closed-revert assertions.
Were RED on main; now green (30 passed).
No eval gate, threshold, or safety boundary changed.
Add docs/claims_ledger.md (every public claim -> in-repo evidence, with the
four GSM8K numbers separated and labeled) and ADR-0200 recording the
mathematics_logic expert fail-closed revert as designed behavior (proven
single-source evidence-drift; determinism intact).
Additive only: no existing claim, eval gate, or test is touched. The
review-gated reconciliation diffs (reviewers.yaml quarantine note, ADR-0120
header note, signed-JSON regen, README narrative, 3 test reconciliations) are
listed in ADR-0200 section 4 and await operator ratification.
The decisions README index table stopped at ADR-0183 then jumped to
ADR-0196, omitting every top-level ADR that landed in between plus the
three newest. PRs #513/#514/#515 added ADR-0197/0198/0199 files without
touching the index; the 0184-0195 gap predates them.
Adds 12 rows in numeric order with title + status pulled from each ADR
header. No content/runtime change; pure index backfill.
- files-vs-index drift check: now empty (was 12)
- all 12 new link targets verified to resolve
The ADR-0191 completeness guard (added after WAVE-A) requires aggregating
initials to expose every consumed source token via
`consumed_value_tokens`, so it can confirm no source quantity was
silently dropped. The WAVE-A "each weighing" injector predates the guard
and left that field empty, so for every "<Subject> <verb> M <outer>, each
... N <unit>" reading the guard computed required={M, N} vs
consumed={M*N} and refused as "incomplete reading: source quantities
[M, N] not consumed". This silently regressed the entire WAVE-A
capability — the canary `test_lilibeth_canary_solves_end_to_end` has been
red on main (it failed byte-identically on f79b647; the smoke gate does
not collect this dedicated test file, so it merged green originally).
Fix: populate `consumed_value_tokens=(count_a_token, count_b_token)` on
the composed initial — exactly the contract the day-enumeration and
embedded-quantifier aggregators already satisfy.
wrong==0 preserved: the two tokens genuinely ARE the multiplicands of the
emitted value; the guard remains refusal-only. Serving frozen: this
shape does not occur in train_sample, so the fix is serving-neutral.
Evidence:
- tests/test_wave_a_multiplicative_aggregation_injector.py: 11 passed
(was 1 failed) incl. test_wrong_zero_preserved (full train_sample eval,
wrong==0).
- core test --suite packs: 141 passed (was 1 failed, 140 passed).
- core test --suite smoke: 67 passed.
- scripts/verify_lane_shas.py: lanes 8/8 match pinned SHAs — the
train_sample_v1 serving SHA is byte-identical, proving zero serving
count change.
PR checklist:
- Capability: restores WAVE-A multiplicative-aggregate reading regressed
by ADR-0191.
- Invariant: wrong==0 (completeness guard stays refusal-only; tokens are
true multiplicands).
- Lane: core test --suite packs / smoke + lane-SHA gate (8/8).
- No hidden normalization, stochastic fallback, approximate recall, or
unreviewed mutation.
- Trust boundary: none widened — internal candidate provenance only.
Single portable 'where we are / what's next' page for the Zig native-substrate
work: gate status per component, the locked G1 CRDT contract, the immediate
next action (a new ADR to clear G2 before any Zig code), env gotchas
(PYO3_PYTHON=3.12; the public_demo wall-clock lane flake), and verification
commands. Lets any operator/agent resume cold.
Sibling links resolve once #509 (docs/zig/**) lands on main; merge #509 first.
Establishes the canonical Delta-CRDT reference contract so a future native
(Rust/Zig) backend is gate-G1-eligible under ADR-0196 — the ZC-0 'contract
pinning' slice. No Zig code; ZC-1+ remains gated at G2.
- vault/crdt.py: canonical Python reference (ArenaEntry, Delta, LocalArena,
merge_kernel, canonical_bytes, delta_hash). Pure content law — content-
addressed by IEEE-754 bits then provenance; no normalization, no versor
closure, no global Vault writes.
- ZC-0 contract tests (semilattice C-1..C-5; content ordering / signed-zero /
NaN bit-addressing; C-7 no-global-write) — all failable (mutation-checked:
no-dedup breaks C3/C5, arrival-order breaks C1).
- Golden fixture corpus (tests/fixtures/crdt/) regenerated deterministically
from the reference; single source of truth also emits the Rust expected hex.
- core-rs: Delta::canonical_bytes + test_crdt_hash_parity.rs proving Rust
produces byte-identical canonical_bytes to the Python reference.
- ADR-0180 -> Accepted: locked contract, byte layout, obligation map, and the
explicit boundary that no Zig is authorized.
Verification: ZC-0 21 passed, Rust arena+parity 16 passed, architectural
invariants 40 passed, smoke 67 passed. Serving frozen: 7/8 lane SHAs match;
the public_demo miss is a pre-existing wall-clock budget overrun (ADR-0099,
~46-48s > 30s) reproduced identically on clean main — environmental.
First foundation-curriculum substrate pack: 24 reviewed noun lemmas for
syntax/claim/provenance vocabulary (subject, predicate, agent_role,
clause, antecedent, consequent_role, polarity, negation, evidence_span,
…). Substrate only — no parser, no runtime generation change.
This is the clean reland of #503 (merged then reverted via #508 for
shipping two failing tests). Root cause of the revert was lemma
collision: the smoke CI gate does not collect dedicated test files, so
the pack merged green while its own test asserted resolver routings that
were false.
Reland fixes, with the full collision audit done against every on-disk
pack (not just the one the original author checked):
- agent -> agent_role (bare `agent` owned by en_core_meta_v1)
- comparison -> comparison_relation(bare `comparison` owned by en_core_cognition_v1)
- consequent -> consequent_role (bare `consequent` owned by en_core_causation_v1)
- negation kept bare on purpose: no *mounted* pack owned it
(en_mathematics_logic_v1 is a domain pack, not in
DEFAULT_RESOLVABLE_PACK_IDS), so mounting syntax now grounds a word
that previously returned None. Renaming would have lost grounding.
The original test also mis-asserted prior resolution: it claimed
`cause` -> en_core_causation_v1, but first-match-wins resolves it to
en_core_cognition_v1 (mounted at index 0). The test now pins the TRUE
current owner; this pack does not change it.
Resolver: en_core_syntax_v1 mounted after en_core_polarity_v1 and before
en_core_relations_v1 — purely additive, steals no prior resolution.
Evidence:
- tests/test_en_core_syntax_v1_pack.py: 13/13 (was 4 failed, 9 passed)
- pack/resolver/grounding/invariants blast radius: 415 passed
- core test --suite smoke: 67 passed
- core test --suite packs: 1 failed, 140 passed — the single failure
(test_lilibeth_canary_solves_end_to_end, GSM8K candidate-graph reader)
is PRE-EXISTING on clean main f79b647, byte-identical, and untouched by
this PR.
- lane SHAs: 7/8 content-match; the public_demo miss is a wall-clock
DemoContractError (>30s budget), not content drift — serving frozen.
PR checklist:
- Capability: foundation-curriculum language substrate vocabulary.
- Field invariant: pack loads through checksum-sealed compiler; no
algebra/versor path touched.
- Lane: core test --suite packs / smoke; dedicated pack test.
- No hidden normalization, stochastic fallback, approximate recall, or
unreviewed mutation.
- Trust boundary: language-pack loading only; manifest checksums hash the
exact bytes on disk (recomputed after the two renames).
Bring the docs/zig/** decision package and README 'Native Substrate
Direction' section into main, and record ADR-0196 (Accepted) as the
binding ratification.
The doctrine is explicitly NOT a wholesale Zig rewrite. It establishes a
ring architecture (Python = semantic source of truth; Rust = incumbent
algebra backend; Zig = Ring 1 native-substrate candidate only) and the
G0-G8 adoption gate ladder. Zig may enter only by clearing gates against
a locked reference contract; default-by-availability is forbidden.
ADR-0196 forward-references ADR-0180 as the first G1 instantiation (the
CRDT contract lock / ZC-0 slice). No Zig code is authorized.
Execution-free brief for the read-only GitHub-connector lane: comprehension-
primitive inventory, question-layer gap survey, subject-readiness recommendation,
then gated capability-axis/ADR/corpus drafts. Proposal-only; serving stays frozen
(wrong=0, pinned lanes). Companion to the Claude execute/validate/commit lane.
