Implement promotion_eligible (closed ∧ drift≤ε), promote live
closure/drift refuse even when authorized, require_proof, and
prune(mode=principal_axes) keeping primals + highest principal-energy
non-primals (differs from FIFO). Proof fields never trusted as truth.
Ledger #18 flipped green; ADR-0092 reviewer service remains external.
Add GoldPromotionProof, expand promote/prune signatures, promotion_eligible
stub, and behavioral suite for residual/closure gates, require_proof,
principal_axes prune, and SERVE containment. Intentionally incomplete:
principal_axes and eligibility raise NotImplementedError; dirty promote
still admitted — RED until GREEN.
Smoke reds came from (1) denormal stream weights powering non-simple splits
and (2) invariant-split factors with B² higher residual in 1e-6..1e-3 dust
band raising fail-closed. Early R^0→I / R^1→R; raise simple B² higher tol
to 1e-3 with named constant. Pins multiplane transition + near-zero alpha.
The self-hosted Actions runner is aarch64 (Apple M1 Linux); the CI toolchain
assumed x86_64, so every workflow has been failing at environment setup — on
main and every PR, not a code regression.
Two root causes, both arm64:
* pyrage==1.2.3 publishes no linux-aarch64 wheel, so uv fell back to an sdist
build and modern uv rejects pyrage's own pyproject.toml ("[project] without
project.version") — "TOML parse error at line 5". Bump to pyrage==1.2.4, the
first release shipping a cp39-abi3 manylinux_2_17_aarch64 wheel (x86_64 and
macOS wheels retained). No source build -> no parse error. Fixes smoke,
full-pytest, contemplation, ratify-proposal.
Verified: age/X25519 encrypt+decrypt round-trips on 1.2.4, and the committed
sealed-holdout artifacts (sealed under 1.2.3) still decrypt
(tests/test_holdout_encryption.py, tests/test_adr_0119_7_sealed_gsm8k.py —
7 passed). No ADR pins the patch version; only a size-tally doc referenced
it (updated).
* lane-shas used actions/setup-python@v5, which has no arm64 build for the
pinned 3.12.13 ("version '3.12.13' with architecture 'arm64' was not found"
-> "python: command not found"). Switch to astral-sh/setup-uv@v5 + uv (uv
provisions arm64 Python reliably), matching the other four workflows.
Files: pyproject.toml (pyrage 1.2.3->1.2.4), docs/model_dependency_size_tally.md,
.github/workflows/lane-shas.yml. uv.lock is gitignored (uv re-resolves per run).
Separate pre-existing issue (NOT addressed here): with setup fixed, lane-shas
now reaches its SHA check, where 2 demo lanes (demo_composition, public_demo)
drift from their pins. This is content drift on main, unrelated to the toolchain
(public_demo is a known wall-clock/env flake). Left for an explicit re-pin vs
degate decision rather than silently re-pinning.
Shared CGA substrate for the #17 conformal-Procrustes/Kabsch and #16
Cartan-Iwasawa decompositions. Adds algebra/null_point.py and hoists the two
conformal null directions to frozen module constants.
algebra/cga.py
- Add frozen read-only f64 N_O / N_INF constants: the same vectors
embed_point builds inline (origin embeds to N_O; N_INF is fixed by every
Euclidean isometry), so the null-point primitives share one exact sign
definition instead of re-deriving it per call site.
- Fix header-docstring sign typo: n_o = 0.5*(e5 - e4), not 0.5*(e4 - e5).
embed_point was already correct; only the module header disagreed.
algebra/null_point.py (new)
- dilator(scale), translator(a): CGA similarity constructors; both
round-trip through the recoverers.
- recover_dilation(V) -> (scale, D): reads V n_inf rev(V), weight-normalised
so recovery is invariant to a non-unit versor weight (verified vs V -> kV).
- recover_translation(V) -> (a, T): reads V n_o rev(V), projective
dehomogenisation.
- NullPointRecoveryError carries machine-readable reason codes.
- Fail-closed symmetric similarity gate (_require_similarity): BOTH recoverers
now reject non-versors (not_a_versor) and non-similarities (not_similarity,
e.g. transversions). Closes an asymmetry where recover_translation silently
accepted a transversion / non-versor and returned a plausible translation,
violating the module's own wrong=0 contract.
- Orientation-reversing (reflection / det=-1) versors are refused by
recover_dilation with a distinct reason improper_versor, kept separate from
degenerate_scale; recover_translation still accepts them (the origin image is
well defined). conformal_procrustes strips reflections upstream, so this is a
documented boundary, not a silent one.
- Default tol=1e-9 documented: matches f64-exact recovery of a cleanly
assembled versor (~1e-14 round-trip); noisy/SVD callers must pass a wider tol.
tests/test_null_point_primitives.py (new): 33 tests - null-cone/pairing
invariants, constant immutability, constructor round-trips, composed T.D.R peel,
versor-weight invariance, and the full fail-closed matrix (transversion,
non-versor, inversion, reflection asymmetry, non-positive scale, bad vector).
Invariant protected: wrong=0 - no recovery returns a silently wrong value on a
degenerate / non-versor / non-similarity input. Validation: 33/33 new pass;
88 passed / 1 xfailed across the CGA substrate + physics Procrustes consumers
(dynamic_manifold, surprise, versor closure, rotor, holonomy).
Hardened via a 3-lens adversarial verification (soundness / sign-convention /
consumer-contract, each executing counterexample versors, every finding
skeptic-verified): 2 CONFIRMED findings fixed (asymmetric validation gap;
reflection reason conflation); tol-tightness resolved by documentation rather
than a guard-weakening default change.
Finding #20 (Super-Blueprint §3.2). surprise_residual was Euclidean Gram-Schmidt
on flat 32-coefficient vectors — metric-blind (it ignored the (+,+,+,+,-)
signature and the blade grade structure), so "inside the admissible span" was
judged by the wrong geometry.
Operator math (core/physics/surprise.py):
- Exact metric-orthogonal projection: solve the normal equations G c = r
(G_ij = cga_inner(b_i,b_j), r_i = cga_inner(b_i,x)) via lstsq, under cga_inner
(32-vec) / eta (5-vec).
- Fail-closed (typed SurpriseResidualError) on a metric-degenerate span, keyed on
rank(G) < rank(B) — a null direction with no reciprocal (lone n_o). Refines the
literal "rank(G) < k": mere linear dependence among non-null columns is admitted
(lstsq projects onto the span), so a redundant live basis [1, source] and the
non-degenerate pair {n_o, n_inf} are admitted; only a lone n_o is refused. The
disclosure names the Gram null-space direction (not just zero-diagonal columns).
- Reconciled productivity polarity: productive_transfer = low Procrustes AND low
surprise (was `sur_norm >= 0.0`, always true). High surprise routes to discovery
(split follow-up). Corrects the ledger's transfer/discovery conflation.
Adversarial verification (3 independent lenses) found, and this fixes:
- HIGH soundness hole: sur_norm was the reversion pseudo-norm, which VANISHES on
a nonzero metric-null residual (the n_o/n_inf light cone) -> false-zero surprise
-> an out-of-span light-cone probe was wrongly admitted as in-span. Now the
DEFINITE (Euclidean) norm of the residual: the projection stays metric-exact,
the magnitude is 0 iff nothing is unexplained.
- HIGH regression: the analogical-transfer harness called surprise_residual
OUTSIDE its try/except, so a degenerate source crashed the whole run. Now
guarded: records a refused case and continues.
- grade-support `allowed` -> exact-nonzero (removes a spurious-leak edge under
coefficient amplification of sub-tolerance grade dust).
DiscoveryCandidate wiring into the contemplation loop is split to its own
follow-up (a distinct cross-cutting surface). Off-serving (nothing in
serving/runtime imports core.physics.*). Tests: 15 behavioral tests
(metric-vs-Euclidean divergence, null-cone regression, null refusal +
combination-degenerate disclosure, 5-vector branch, polarity); 139-test physics
sweep green; ruff clean.
The Super-Blueprint §3.3 "grade-5 pseudoscalar alignment anchor" is
mathematically vacuous in odd-dimensional Cl(4,1) and cannot be built as
specified (3-agent R&D convergence — Opus/Grok/Terra — ratified):
- I₅ is central in odd dim → V·I₅·Ṽ = ±I₅ for every versor; orientation is
invariant by construction (nothing to block).
- Field-state versors are even → F[31] ≡ 0; the gated ⟨F·F̃⟩₅ = 0 for the
source and target of every transition. The gate compares 0 == 0.
- The "even-versor parity gate" repair is equally vacuous (even subalgebra is
closed under the sandwich; odd-grade mass ≡ 0 on the sanctioned path).
Removes the namesake rather than leaving it masking an absence:
- Delete _PSEUDOSCALAR_IDX + all F[31] reads (dead `ps` history element and
CoherenceResidual.pseudoscalar — both structural zeros).
- Rename telemetry channel pseudoscalar_floor → autonomy_floor (it was always
self.floor, the earned-autonomy ceiling).
- Bump telemetry schema goldtether_coherence_v1 → v2 (shape changed).
The integrity-anchor role is subsumed by versor closure + GoldTether harmonized
residual (#24) + biography/identity holonomy. Ledger §5 rewritten with the
vacuity proof, subsumption, and the reusable "would this gate ever fire on the
sanctioned construction path?" meta-criterion.
No serving/runtime path touched (core.physics.* is off-serving). Tests: 33 pass
/ 1 xfail (Cartan #2) across goldtether + fidelity + miner + transfer suites;
ruff clean.
Implements the ADR-0238 §2.3 / R&D-Revised §2.3 machinery the skeleton omitted
(fidelity finding #4, issue #18):
- Gold-invariant set 𝓘_gold seeded with the primal {identity, n_o, n_inf}
(R&D §5 bootstrapping seeds), so the geometric term never degenerates at
cold start.
- goldtether_residual: scale-harmonized R = w·(drift/ε) + (1−w)·(min‖F−I‖/‖F‖),
both terms scaled to [0, O(1)] so neither masks the other — the exact defect
§2.3 exists to fix. The raw coherence_residual stays the fail-closed closure
gate; this is the alignment signal that drives α.
- alpha_constraint = Φ(R_gt; r_floor, r_critical): the smooth-step constraint
weight, composed with the earned-autonomy ceiling (α_floor = 1 − autonomy)
and serve-pinned-to-1. supervised_transition rides the exact geodesic (#23).
- promote/prune gold-set hooks (caller-gated; the ADR-0092 replay-verified
promotion pipeline + principal-axis decay are deferred, per issue #18).
Reconciliation (design): the earned-autonomy ramp (lifetime trust ceiling) and
α=Φ(R) (per-transition blend) compose at two timescales rather than compete —
earned autonomy floors α, Φ(R) modulates within it, serve is never autonomous.
All existing GoldTether behavior/tests preserved; fail-closed + serve-never-
autonomous intact.
rotor_power previously returned the IDENTITY for any non-simple rotor — an
approximation where exactness was available (Pillar II, Semantic Rigor) that
silently collapsed geodesic interpolation (slerp / supervised blend) to a
no-op while closure stayed green. Replace the identity-fallback with the
invariant (bivector) decomposition: a general Cl(4,1) rotor factors into two
commuting simple rotors R = R1 R2, so R^a = R1^a R2^a exactly, each via the
existing simple closed form, with a dedicated closed form for the isoclinic
(coincident-plane) case. Built from the geometric product alone — no scipy,
no GA library (Pillar III, Third Door); exact f64 on the existing product
table (Pillar I, Mechanical Sympathy).
- Simple path is byte-identical (0.0 delta); 66 existing algebra tests pass.
- tests/test_rotor_power_general.py pins R^1=R, (R^.5)^2=R, R^a R^b=R^(a+b),
R^0=1, closure, isoclinic, and replay determinism across every plane type
incl e5 boosts (441 pass), to machine precision (<= 6.5e-10).
This is the substrate cause of the Third-Door blend degeneration (fidelity
finding #1, issues #16/#18): with a real rotor_power, supervised_blend and
dual_correction_slerp now interpolate monotonically and land on target. Once
merged, the ADR-0239 blend xfail on #15 flips green.
core-bootstrap.md linked docs/dev/git-forgejo.md, which was removed as
deprecated (c0cbd13d) — the git+Forgejo setup lives in AGENTS.md. Drop the
dead link. Surfaced by the main-lineage reconciliation audit.
Master honest ledger for the ADR-0238/0239/0240 skeleton: per-operator
blueprint spec, actual landed code, precise gap, reproducible evidence, and
what 'done right' requires. Tracks follow-ups #16-#21. Replaces the Mastery
Report framing with a verifiable spec-vs-impl record.
Composed-versor tests the ADR-0239 suite never exercises. Two spec-property
tests xfail (strict) citing Super-Blueprint §2.2 / R&D-Revised §2.3; two
characterization tests lock the current degenerate behaviour so a future fix
is forced to update them.
- supervised_blend: no-op for interior alpha on composed (non-simple) versors
- cartan_iwasawa_factorize: raises 'factor R not closed' on composed versors
DeltaStore.frontier returned the live internal set. A delta built with
parents=store.frontier aliased it, so insert's frontier maintenance
(add + difference_update) emptied the frontier on every insert and
rewrote every stored delta's parents to {} — the CRDT causal chain
degenerated into all-roots. Sopher's bridge now copies on its side
(sopher ADR-0026.1 §2.1); this is the recommended CORE-side defense in
depth: frontier hands out snapshots, and insert copies delta.parents
into the event envelope.
Regression-tested with the exact aliasing pattern (3-delta chain keeps
one head and stable per-delta parents).
