Stop-and-document outcome for issue #680's final runtime wiring. The
serving turn has no lawful in-turn ContemplationResult or provider: the
sole QUESTION_NEEDED producer (generate.contemplation.contemplate) is an
off-serving growth organ that runtime is forbidden to call, and no
plumbing carries its artifact into the turn. Wiring is deferred to a
lawful acquisition slice; chat/runtime.py is left untouched.
Adds a small chat.ask_runtime helper that consumes the ASK acquisition seam without editing chat/runtime.py.
- Uses honest contemplation_result keyword forwarding
- Preserves fallback behavior when ASK serving is disabled
- Does not call pass_manager or render_question
- Does not change public chat/runtime schema
Backs out the direct main push that added _maybe_apply_served_ask using a string-concatenation workaround to evade an over-broad text guard.
Restores chat/runtime.py to the #678 merge state and removes tests/test_ask_runtime_hook.py so the next runtime hook can land through a reviewed PR with structural tests instead of guard bypasses.
- This is the smallest runtime consumption hook for the ASK acquisition seam.
- It is default-dark.
- It preserves normal runtime behavior when disabled.
- It does not change public `chat(...)` signature.
- It does not change `ChatResponse`, `TurnEvent`, or telemetry schema.
- It does not call/render question prose.
- It does not serve from `proposal_path`.
- It does not retire Q1B carve-out or flip `proposal_allowed`.
- It does not serve VERIFIED.
- It does not move CLAIMS or metrics.
Adds the Stage 2 served ASK artifact adapter and adapter-only tests.
- Validates Q1-D DeliveredQuestion artifacts before ASK eligibility
- Uses ask_serving_enabled as a default-dark gate
- Uses the disclosure bus disposition mapping
- Fails closed to fallback surface/disposition on invalid artifacts
- Does not wire chat/runtime, telemetry, TurnEvent, ChatResponse, CLAIMS, or metrics
- Does not retire Q1B_ASK_CARVE_OUT or flip proposal_allowed
Adds dedicated ContemplationResult.question_path for off-serving ASK artifacts and stops storing QUESTION_NEEDED question paths in proposal_path. Proposal artifacts remain under proposal_path. No chat/runtime wiring, served ASK surface, Q1B carve-out retirement, registry flip, or CLAIMS/metric movement.
Adds off-serving pass_manager integration for ASK delivery through deliver_ask behind explicit exercise_ask. Preserves boundary-first ordering, writes question artifacts to the question sink via question_root, avoids double delivery, and keeps chat/runtime, served ASK, Q1B carve-out, registry, CLAIMS, and metrics untouched.
Adds explicit default-false RuntimeConfig ask_serving_enabled and verified_serving_enabled fields while preserving default-dark helper behavior. Includes focused ASK/VERIFIED gate tests and cross-gate independence coverage. No pass_manager wiring, runtime wiring, verify.py wiring, served behavior, or CLAIMS/metric movement.
Adds a default-dark verified_serving_enabled helper with focused tests. The helper is unwired: no runtime integration, no verify.py wiring, no eval producer imports, no served VERIFIED behavior, and no CLAIMS/metric movement.
Adds a default-dark ask_serving_enabled helper with focused tests. The helper is unwired: no pass_manager integration, no runtime surface, no carve-out retirement, and no served question text.
Rewrites the Q1-D ASK bus delivery scoping document into the durable decision record for decisions implemented in #668. No code or runtime behavior changes.
Accepts the ASK + VERIFIED serving-integration scoping briefs.
No served-surface code is introduced. ASK is identified as the next gated serving slice; VERIFIED remains blocked on a gold-free second reader and explicit eval-gold serving ban.
Per review: 'proposal-only' described the Q1-D sink/artifact in two docstrings,
conflating two distinct lanes. A question is an intake request, not a capability
proposal; question_only is its own lane. The analogy to the proposal emitter is
structural (toothless, review-gated, never served), never semantic. Tighten the
sink/artifact docstrings and rename the sink test to *question_only* to match
_QUESTION_STATUS. No behavior change — docstrings + one test name only.
The fourth and final Q1 rung: route the Q1-C rendered question onto the
contemplation bus as the QUESTION_NEEDED tenant (sibling of PROPOSAL_EMITTED),
off-serving. Consumes render_question VERBATIM — Q1-D constructs no prose, so the
Q1-C grounded-rendering wrong=0 guard is never bypassed by a second surface.
- generate/contemplation/findings.py: add Terminal.QUESTION_NEEDED.
- core/epistemic_disclosure/limitation.py: ask_question's home terminal is now
QUESTION_NEEDED, making terminal_for_action total (all six actions map onto
shipped terminals — the consolidation proof is now complete, not 'five of six').
- core/epistemic_questions/delivery.py: DeliveredQuestion (proposal-only artifact,
cannot wrap an unrenderable question / cannot be served / answer_binding reserved
None — illegal states unrepresentable), DeliveryOutcome, deliver_ask, the
teaching/questions sink emitter, and AnswerBinding (reserved for Q2).
Rulings honored:
- D1: off-serving only — no served surface, no ask_serving_enabled, no chat wiring.
- D2: an unrenderable ASK falls back to the family's standing disposition
(PROPOSAL_EMITTED if it still proposes, else NO_PROGRESS) — never a contentless
QUESTION_NEEDED. Enforced twice: in deliver_ask and structurally in __post_init__.
- D3: Q1B_ASK_CARVE_OUT untouched — registry keeps proposal_allowed=True; both
signals coexist off-serving so no operational signal is lost.
- D4: sink under teaching/questions/ (sibling of teaching/proposals/).
- D5: strictly single-slot — multi-slot is unrenderable, takes the D2 fallback.
Tests: 16 delivery tests (happy path verbatim, both D2 fallback branches,
structural guards, idempotent sink, off-serving AST) + updated the two limitation
consolidation tests for the now-total terminal map. smoke 90/0, affected suites
128/0.
The template asserts 'one more value is still needed' (exactly one). Rendering
the first of several missing slots and ignoring the rest makes that claim
subtly false. Refuse multi-slot assessments with multi_slot_not_supported
(slot=None) rather than render-first-drop-rest; one-question-per-slot fan-out
is a later rung. Replaces the now-contradicting first-of-many test with a
test that pins the honest refusal.
Add core/epistemic_questions/ — the renderer rung of the ASK spine.
render_question(LimitationAssessment) -> EpistemicQuestion turns ASK typed
residue into a user-facing question or an explicit question_unrenderable verdict.
Render only: no bus delivery, no served disposition, no serving (that is Q1-D).
Policy (scoping §2 / session §1.5.7 wrong=0 invariant): a question may name a
problem entity only if it appears verbatim in grounded_terms. Two substrate facts
force a generic-structural policy today: grounded_terms is empty everywhere (the
readers do not yet emit verbatim evidence), and a *missing* slot's referent is by
definition absent from the trace. So the renderer:
- renders a generic question whose only variable content is a controlled English
phrase for the slot's expected_unit_or_type, from a closed audited map;
- never surfaces slot_name or binding_target (snake_case), never prettifies an
identifier into a natural-language entity, never names a problem entity;
- degrades unmapped types to question_unrenderable (renderability_gap) rather
than dumping raw snake_case;
- single-slot (first slot only); non-ASK / zero-slot -> unrenderable;
- post-render fabrication guard re-checks every token is closed-vocab scaffold or
grounded (defense in depth).
Off-serving: imports no generate.derivation / core.reliability_gate (AST-tested).
Tests: 9/9 green; smoke 90/0.
Adds bound_slots_digest as a distinct VerificationProof obligation before any serving wiring. Keeps the VERIFIED lane off-serving while separating derivation, stated-slot binding, and back-substitution.
Reclassify missing_total_count / missing_weighted_total in the limitation layer
from (capability_gap, emit_proposal) to (missing_information, ask_question) —
the user CAN state the total, so these are missing data, not capability gaps.
Add typed ASK residue (MissingSlot, grounded_terms) on LimitationAssessment;
defaults to empty so existing P0-1 callers continue to work.
Q1B_ASK_CARVE_OUT: the shipped failure_family REGISTRY still flags both as
proposal_allowed=True so existing consumers (proposal pile, contemplation
pass_manager) keep emitting proposal artifacts until Q1-C/Q1-D wires ASK
delivery. Flipping the registry flag before ASK is served would create a
no-proposal/no-question dead zone — a capability-regression window with no
compensating intake. The carve-out is named, enumerated, and explicit; once
ASK delivery is live the REGISTRY flag flips and the carve-out retires.
Wrong=0 invariant on residue (scoping §2): MissingSlot carries family-typed
structural identifiers only (snake_case); grounded_terms is verbatim text from
ComprehensionAttempt.evidence SourceSpanLinks — never fabricated from family
or refusal_reason. Today classify_* leaves evidence empty for refusals, so
grounded_terms is empty everywhere; the wiring is ready for the residue
upgrade to readers later.
Off-serving: limitation.py imports no generate.derivation / core.reliability_gate
(AST-guarded by test_limitation_module_is_off_serving). No renderer, no bus
delivery — those are Q1-C/Q1-D.
Tests:
tests/test_limitation_assessment.py — 39 passing
+ test_proposal_allowed_iff_emit_proposal_with_q1b_ask_carveout (amended INV-A)
+ test_missing_{total,weighted}_count_limitation_is_ask_oriented
+ test_q1b_ask_carveout_is_explicit_and_enumerated
+ test_registry_proposal_allowed_preserved_until_ask_delivery
+ test_no_signal_loss_before_question_bus_is_serving (live pass_manager check)
+ test_missing_{total,weighted}_count_has_typed_missing_slot_residue
+ test_grounded_terms_populated_only_from_evidence_spans
+ test_residue_never_contains_ungrounded_terms
+ test_residue_empty_for_non_ask_attempts
+ test_missing_slots_default_empty_for_non_ask_families
+ test_missing_slot_keys_are_subset_of_ask_families
+ test_limitation_module_is_off_serving (AST guard)
Suites:
tests/test_epistemic_*.py, test_disclosure_claim.py, test_served_disposition.py,
test_verified_contract.py, test_failure_family.py, test_failure_proposal.py,
test_r3_router_contemplation.py, test_proposal_review_*.py,
test_idle_proposal_review.py — 135 passing
core test --suite smoke -q — 90 passing
The first consumer of the P1-A VERIFIED contract. Given an R2 problem (prose) +
the INDEPENDENTLY hand-authored gold SETUP, it builds a VerificationProof and runs it
through the contract. NOT a serving-time VERIFIED producer: it depends on the eval-lane
gold setup (off-serving only), cannot move any serving metric, cannot emit served
[verified]. Serving-time independence (a non-gold second reader) is a separate, larger
rung, explicitly deferred.
evals/constraint_oracle/verified_producer.py (placed in evals/, not core/, to avoid a
backwards core->evals import: it needs the reader+solver (generate), the canonical
signature + gold (evals), and the contract (core) — clean direction evals->core+generate):
- verify_r2(text, gold_setup) -> R2VerificationOutcome.
- Two independent reads: primary = read_constraint_problem(text) (lineage
constraint_reader_v1); independent = the gold-authored setup (lineage
constraint_gold_author_v1). Convergence = equal constraint_setup_signature digests
(the SAME function for both reads). The gold ANSWER never enters — only the gold
STRUCTURE, through the signature.
- A wrong reader structure diverges from the gold-authored structure -> reads_disagree
-> NOT_VERIFIED (the poison). Reader refusal -> no proof + a limitation. Solver
boundary -> boundary_clear False -> NOT_VERIFIED. VERIFIED state/claim reached ONLY
via disclosure_for_verification.
On the real r2_gold lane (13 records): VERIFIED=7 (exactly the 7 'solved'),
NOT_VERIFIED=6 (3 solver_refuses + 3 reader_refuses) — wrong=0.
11 tests: integration over real gold (verifies >=1, never on divergence); all 7 solved
verify; the poison (divergent independent read -> reads_disagree); reader-refusal -> no
proof + limitation; solver-boundary -> not verified; distinct/named lineages; the
sanctioned route; all digests populated; gold answer structurally cannot enter; off-serving.
NOTE (bound_slots_digest): the P1-A VerificationProof (merged, unchanged per scope) has
no bound_slots_digest field; the "bound to stated quantities" obligation is carried by
derivation_digest (hashed over the canonical constraints + solution). Flag to extend.
Off-serving; smoke 90/0.
Defines what it MEANS for a result to earn DisclosureClaim.VERIFIED /
EpistemicState.VERIFIED — the soundness≠correctness gate the whole VERIFIED lane
rests on. Contract ONLY: no producer, no reader, no solver, no serving, no
verify.py, no verified_serving_enabled, no claim emission in any serving path.
core/epistemic_disclosure/verified_contract.py:
- VerificationObligation — the declarative contract (4 load-bearing flags);
VERIFICATION_OBLIGATION is fully strict.
- VerificationProof — the replayable proof SHAPE P1-B+ will fill (two reads kept
separate: distinct lineages for independence, matching digests for convergence).
- evaluate_verification(proof, *, limitation, obligation) -> VerificationResult —
refuse-preferring: VERIFIED only if EVERY obligation survives.
- disclosure_for_verification(result) — the ONLY sanctioned route to
(EpistemicState.VERIFIED, DisclosureClaim.VERIFIED); anything else -> UNDETERMINED/NONE.
The mechanism that makes the lane safe: VERIFIED requires TWO INDEPENDENT reads
(distinct lineages) that CONVERGE on one canonical structure. A faithful solve of a
WRONG read is caught because the independent read disagrees (back-substitution alone
cannot catch a read error); "same answer twice" is rejected as not independent.
Neither gold-agreement nor no-refusal nor a second solver over one read can verify.
15 tests, all non-vacuous. THE central test rejects a faithful solve of a wrong read;
one proves the wrong-read obligation is load-bearing (relax it -> poison slips the
check); the full chain composes proof -> contract -> (VERIFIED, VERIFIED) -> P0-3
DISCLOSE, and the poison degrades to COMMIT. Off-serving; smoke 90/0.
The third axis of the bus: choose_served_disposition composes
EpistemicState × LimitationAssessment × DisclosureClaim → ServedDisposition.
Pure mapping — no rendering, no bus behaviour, no verify.py, no govern_response
mutation. Nothing consumes it yet.
core/epistemic_disclosure/disposition.py:
- ServedDisposition(str, Enum): commit | disclose | ask | propose | report |
explain | refuse | step_aside.
- choose_served_disposition(*, epistemic_state, limitation, disclosure_claim=NONE):
a blocking limitation dominates (its resolution_action -> ask/propose/report/
explain/refuse/step_aside; scope_boundary -> EXPLAIN, NOT a hard REFUSE);
otherwise the disclosure claim + state pick the serve mode.
The Phase-1 VERIFIED guard (load-bearing): a DisclosureClaim.VERIFIED discloses
ONLY when EpistemicState.VERIFIED backs it; an unbacked verified claim degrades to
a plain COMMIT — never served as verified before the producer exists.
30 tests: the load-bearing rules via REAL P0-1 assessments; the VERIFIED guard
parametrized across all 14 non-VERIFIED states; limitation-dominates-claim;
answer-action fall-through; totality over both axes; off-serving. Smoke 90/0.
A served response carries two ORTHOGONAL governance properties: ReachLevel (how
far past grounded fact it reaches) and DisclosureClaim (the epistemic claim it
makes about its own truth status). "verified" is NOT a reach level — it is a
proof-state claim. Keeping the axes separate is the locked Stage-2 decision (no
ReachLevel.VERIFIED; a proven answer never inherits an [approximate] surface).
core/epistemic_disclosure/disclosure_claim.py:
- DisclosureClaim(str, Enum): none | verified | approximate | proposal_only.
Default = none. str-valued for stable serialization (EpistemicState convention).
- Discipline "no claim without a producer": every member has a real (APPROXIMATE
= cognition Step E; PROPOSAL_ONLY = teaching/proposals) or imminent (VERIFIED =
Phase 1 target) emitter. PROVEN and ESTIMATED are intentionally ABSENT — nothing
emits them; ESTIMATED is a future split of APPROXIMATE, added only when a real
estimator producer exists (docs-note only).
Also folds the P0-1 review nit: _KIND_TO_STATE / _ACTION_TO_TERMINAL tightened
from dict[str, ...] to their Literal key types.
9 tests, non-vacuous: default is NONE; verified is not a ReachLevel (structural);
claim axis disjoint from ResolutionAction; PROVEN and ESTIMATED absent; exactly the
approved four; str-enum serialization; module imports nothing (off-serving).
No bus behaviour, no ServedDisposition mapping (that is P0-3). Off-serving; smoke
green (90 passed) locally.
The intake gate of the Epistemic Disclosure spine: classify WHAT KIND of
limitation blocks resolution before choosing a served disposition. Asking is
one resolution among six; mis-classifying breaks intake (refuse-when-should-ask
loses the unlocking datum; ask-when-should-propose wastes the channel).
New off-serving package core/epistemic_disclosure/:
- LimitationKind (8) / ResolutionAction (6) / LimitationAssessment
- the mapping DERIVED from the shipped failure_family REGISTRY + contemplation
Terminal set — a consolidating VIEW, not a fourth taxonomy. The only genuinely
new action is ask_question (the one action with no shipped terminal); every
other action maps onto an existing Terminal (terminal_for_action proves it).
- assess_from_family / assess_from_attempt; conservative refuse default
(an unclassified reason NEVER becomes an answerable question — wrong=0-safe).
The missing_total_count / missing_weighted_total reclassification
(capability_gap -> missing_information) is DEFERRED to Q1-B with its own tests,
not made here; PENDING_Q1B_RECLASSIFICATION + a tripwire test document it.
27 tests, all non-vacuous (each fails under a single mis-keyed entry): totality
over REGISTRY, flag-consistency invariants (proposal<->propose; contradiction
verdict reports; foreign text steps aside), the wrong=0 invariant (hard_boundary
never asks), load-bearing specific mappings, the consolidation proof, and the
attempt-level paths.
Off-serving: imports no generate.derivation / core.reliability_gate (AST-checked);
cannot move the sealed GSM8K metric. Nothing consumes resolution_action yet.
Smoke green (90 passed) locally.
Resolve the one open S2-1 design decision in the doc before it leaves draft:
VERIFIED must NOT reuse ReachLevel.APPROXIMATE or the [approximate] prefix.
- §0: add the claim-vs-reach caution — VERIFIED is a disclosed-surface
*license / verification claim*, not a point further out on the speculation
scale; it is more LICENSED than strict/gold, not more speculative. Record the
principled three-axis decomposition (Disposition × DisclosureClaim × ReachLevel)
and allow v1 to collapse to a distinct ReachLevel.VERIFIED iff it carries its
own admissible-set, rationale, and [verified] prefix.
- §4: replace the open question with the settled S2-1 decision (Shay's wording):
VERIFIED gets a distinct disclosed-surface mode with its own deterministic
[verified] prefix; APPROXIMATE is for bounded estimates, VERIFIED for
independently-confirmed answers under the canonical-comparison contract.
- §1 SQ-5, §9 S2-1, §11 non-claims: propagate — only the enum shape
(distinct ReachLevel.VERIFIED vs a separate DisclosureClaim axis) is left to S2-A.
Still scoping only — NO CODE. Stays DRAFT pending Shay's design-lock.
Scope the frontier after the frozen R1–R4 comprehension ladder: the
served-surface disclosure machine and its first two tenants. Scoping
only — NO CODE.
- session doc §1.5 — the pre-question limitation pass / intake gate:
classify the limitation KIND before choosing a disposition (asking is
one of several). Key phrase: question-asking is the intake mechanism
for resolvable missing state; limitation assessment is the gate that
decides whether intake is appropriate.
- Doc 1 (primary) — the Epistemic Disclosure Bus:
EpistemicState + LimitationAssessment → ServedDisposition, two axes
(DISPOSITION × the existing ReachLevel). VERIFIED is the ONLY v1
tenant; ASK/PROPOSE/REPORT/SCOPE reserved. Grounded in the built-but-
inert ADR-0206 seam (govern_response/shape_surface; _canonically_verified
returns None at verify.py:188). Honours the 2026-06-06 dead-path
verdict: v1's VERIFIED producer is a comprehension-organ answer (R2
first, R4 second) with independence in the READING not the solving,
validate-first holdout (INV-25) BEFORE any widening, behind a new
verified_serving_enabled=False, GSM8K seal untouched.
- Doc 2 (companion) — Q1 question articulation: maps the four ASK
dispositions onto the shipped failure_family registry; the
missing_total_count / missing_weighted_total reclassification (decide
with tests, never silently re-key); the grounded-rendering wrong=0
invariant; the structured-residue-on-refusal gap; Q2 re-enters the
gate (augment + rerun, never mutate). Second bus tenant.
HOLD for review.
Records the design reached in discussion: the first real skill of contemplation
is typed, deterministic, failure-family-driven question generation. A question is
a typed request for missing state, not a conversational habit. Proposes
core/epistemic_questions/ organ (EpistemicQuestion, MissingSlot, AnswerBinding),
the QUESTION_NEEDED terminal distinct from PROPOSAL_EMITTED, and the Q1/Q2 PR
ladder. Traces the connection to the ServabilityBlade clarify mode and the
minimal-sufficient-question discipline.
