A model-style proposer submits a claim, evidence bundle, and optional
bounded-inference block; CORE alone assigns the typed epistemic state
drawn from the canonical core.epistemic_state taxonomy (no parallel
enum) and emits a deterministic, replayable evidence artifact.
The proposer cannot set assigned_state, status, trace_hash,
authority_path, evidence_ledger, or normative_clearance: the closed
recursive schema rejects any root-level injection before state
evaluation runs, and proposer-supplied proposed_state/trace_hash are
recorded as ignored and never read.
Adds closed schema, six fixtures, pinned expected artifacts, a
double-run byte-identical runner with hardened output-dir policy, and a
22-test suite. No network, subprocess, eval/exec, model API, or side
effects beyond demo output.
Tool Authority Demo (#688) was still tagged 'draft PR / in review' but it
merged at c55f7dfb. Hybrid Verification Demo (#687) lacked the claims-authority
framing and the agreement-is-not-safety finding. Reposition both as merged
evidence, name the next public evidence target, and align epistemic-state vocab.
- #687 = authority over claims; #688 = authority over proposed tool actions.
- Removed stale 'In progress / draft PR / in review' status on #688.
- Added explicit next-target ordering: Epistemic Truth-State -> Embodied
Authority Simulation -> SaaS/On-Prem Boundary.
- No named-company, outreach, or production/robotics overclaims introduced.
A narrow, auditable proof path for the hybrid-mode boundary: a
Claude/Fable-style System 1 proposer submits an MCP-shaped tool call
(core.semantic_derivation.verify); CORE re-derives via the ADR-0184
derivation lane, keeps sole acceptance authority, refuses or asks when
it cannot honestly answer, and emits a deterministic replay/provenance
trace for every decision.
Boundary properties (each pinned by a failing-if-removed test):
- the proposer has no commit path: additionalProperties:false schema,
and the demo modules import nothing from generate.* (AST-scanned with
a planted-bypass self-test) — the lane is consumed only through the
ADR-0184 S4b audited trace facade;
- 'verified' requires pool commit AND clean commit-law/faithfulness
audits AND a gold-audited envelope.json entry AND byte-match to the
pinned derivation trace (measured: 118 of the off-serving pool's 231
corpus commits disagree with lane gold, so a bare pool commit is
never served — scenario s4 shows the refusal on a commit that even
matches gold);
- the ask leg is the real Q1 stack (router -> limitation -> Q1-D
producer -> carried handle -> gated serving), dark by default,
tamper-fail-closed on the content hash;
- authority_path names only consulted authorities; responses are
deterministic (double-run byte-identical) and pinned under expected/.
No serving/runtime change; no CLAIMS/metrics/telemetry/lane-pin
movement; no network or Anthropic API dependency (System 1 payloads are
clearly-labeled static fixtures).
- Explicit System 1/2 framing in thesis and §2 (Claude proposes; CORE decides)
- Named Bounded Transition Guarantee (v2.1) callout box in §2
- Conditioned false-positive claim on correctly specified Anchor (§1)
- Named Type-Safe Local Closure security model in Lens layer and §5 Signal 1
- §7 renamed 'The Ask — Hybrid Mode Wedge' with MCP-shaped experiment framing
- §5 stats (716/716, 0 wrong) explicitly tied to BTG, not tuning/sampling
- §6 Honest Limits: explicit Hybrid vs Native Mode distinction added
- Harmful variant table row: 'licensed scope is a ratified human policy decision'
ADR-0184 S4b — the replay/provenance equivalence boundary, the
precondition for any semantic-primary path. After #685 the in-repo
legacy path delegates to the semantic boundary, so old-vs-new is
vacuous; the durable reference is a pinned canonical trace artifact
(evals/gsm8k_math/equivalence/v1/, 937 problems) whose authority is
the #684/#685 cross-tree differentials (documented provenance chain).
- state/provenance.py: replay_is_faithful — the replay bridge's law as
a checkable structural property (no verify/pool import; covered by
the #685 authority scan).
- equivalence/trace.py: canonical traces (worlds, candidates, order,
multiplicity, classifications, resolutions) + authority_violations
re-deriving the pool commit law from trace content.
- scripts/verify_semantic_equivalence.py: check / --update gate
mirroring verify_lane_shas.py.
- tests/test_adr_0184_s4b_replay_equivalence.py: full-corpus live-vs-
pinned equality, corpus-wide authority + faithfulness, and 17
single-mutation non-vacuity proofs.
Pure additions; verify.py/pool.py untouched; no serving, CLAIMS,
metrics, or lane pins moved.
ADR-0184 §7 S4: add generate/derivation/state/source.py — the single
boundary through which semantic-ledger worlds become pool candidates —
and swap pool.py's accumulation source to semantic_state_candidates().
accumulate.py keeps its public surfaces as thin compatibility wrappers
(ADR-0184 §10). Byte-identical over the 937-problem differential;
verify.py / pool.py remain the sole commit authority (structural
no-authority-import scan over state/, non-vacuous).
Also: docs/analysis design note for the S3–S5 boundary stack, and a
drive-by ruff F541 fix in r1_reconstruction.py (rf->r, zero behavior).
Compare resolved canonical Path values, not raw string spellings, when
detecting a question_path / proposal_path collision. A relative
proposal_path and an absolute question_path that name the same file now
fail closed with reason "path_collision" instead of resolving.
Adds a regression test for the absolute-vs-relative same-file collision
and keeps the existing exact-string collision test. The new test is
non-vacuous: it fails under the prior raw-string comparison.
Scope: ask_handle.py seam + its test only. No runtime.py, CLAIMS,
metrics, telemetry, schema, or lane-pin changes.
ADR-0184 S1 (state/bind.py, state/change.py) landed the reusable referent and
change-cue helpers. S2 adds the first explicit state-transition substrate and
routes both accumulation readings through it:
- state/model.py frozen SET/GAIN/LOSS transition model over one entity/unit
StateKey, with structural validation (closed op set; unit is a
str with "" = unitless, mirroring the extractor's Quantity.unit
contract; entity optional, mirroring leading_subject_token).
- state/ledger.py build_accumulation_ledger() — the proven single-referent
gain/loss reading, expressed as a SemanticLedger.
- state/replay.py replay_accumulation_ledger() — the only bridge to
GroundedDerivation; refuses any non-accumulation ledger shape
(non-SET start, cross-key mutation).
accumulate.py's _build_accumulation / _build_accumulation_anchor_skip now build a
ledger and replay it instead of constructing the arithmetic chain inline; the
public compose_accumulation()/accumulation_candidates() surfaces are unchanged.
Behavior-equivalent: a byte-for-byte differential over 937 real GSM8K problems
(accumulation_candidates, compose_accumulation, pooled_candidates, resolve_pooled)
shows 0 differences vs main. Semantic worlds never commit directly — replay emits
GroundedDerivation and verify.py / pool.py remain the sole authority. Sealed: no
serving/runtime/chat import; no CLAIMS or eval-lane-SHA movement.
Refs ADR-0184 section 7 (S2).
The missing-boundary doc (#682) established that chat/runtime.py has no
lawful in-turn provider for a QUESTION_NEEDED ContemplationResult: the
only producer is the off-serving contemplation pass, and scanning
teaching/questions/ would be new, unspecified acquisition logic. This
slice builds the recommended unblocking seam instead of the forbidden
runtime shortcut: carried-handle acquisition.
core/epistemic_disclosure/ask_handle.py:
- AskArtifactHandle — an explicit, caller-carried reference to one
already-produced Q1-D DeliveredQuestion artifact. Provenance is the
producer's own content address (sha256 of blocking_reason:slot_name:
text, also the artifact filename stem) — the only identity field the
Q1-D artifact carries today. No turn/case provenance exists yet; that
boundary is documented, not invented.
- resolve_served_ask_handle — gate-first (zero filesystem access while
ask_serving_enabled is dark), structural handle validation, single
explicit-path artifact read (no glob/iterdir/scan), and content-hash
re-derivation so a stale/replaced/tampered artifact fails closed.
Emits a ResolvedAskCandidate duck-typed to what evaluate_served_ask
reads (terminal/question_path/proposal_path) — no question prose is
ever constructed or carried.
- acquire_served_ask_from_handle — composes resolution into the
existing acquire_served_ask_candidate / evaluate_served_ask stack.
All Q1-D artifact policy (status/review/served/answer-binding/text/
slot/collision) stays delegated; the seam owns identity only.
Not changed: chat/runtime.py, chat(...) signature, ChatResponse,
TurnEvent, telemetry schema, Q1B_ASK_CARVE_OUT, proposal_allowed,
VERIFIED serving, CLAIMS/metrics/lane pins. The seam imports neither
generate.contemplation (pass_manager) nor core.epistemic_questions
render/delivery — enforced by AST tests.
Tests (tests/test_ask_handle.py, 18 cases): gate-dark no-I/O proof,
fallback preservation, valid resolution served end-to-end through the
existing stack, proposal-artifact / missing / malformed / invalid-Q1-D
/ path-collision / stale-hash / non-addressed-filename / structurally-
invalid-handle fail-closed paths, no-discovery-without-exact-handle,
and AST guards for scan primitives, forbidden imports, and prose.
Verification: focused ASK+governance suites 396 passed; architectural
invariants 56 passed; smoke-equivalent suite 90 passed; lane SHAs 8/9
content-match (the 9th is the documented local public_demo wall-clock
flake, 48.3s vs the 30s ADR-0099 budget — no content drift, no re-pin).
Stop-and-document outcome for issue #680's final runtime wiring. The
serving turn has no lawful in-turn ContemplationResult or provider: the
sole QUESTION_NEEDED producer (generate.contemplation.contemplate) is an
off-serving growth organ that runtime is forbidden to call, and no
plumbing carries its artifact into the turn. Wiring is deferred to a
lawful acquisition slice; chat/runtime.py is left untouched.
Adds a small chat.ask_runtime helper that consumes the ASK acquisition seam without editing chat/runtime.py.
- Uses honest contemplation_result keyword forwarding
- Preserves fallback behavior when ASK serving is disabled
- Does not call pass_manager or render_question
- Does not change public chat/runtime schema
Backs out the direct main push that added _maybe_apply_served_ask using a string-concatenation workaround to evade an over-broad text guard.
Restores chat/runtime.py to the #678 merge state and removes tests/test_ask_runtime_hook.py so the next runtime hook can land through a reviewed PR with structural tests instead of guard bypasses.
- This is the smallest runtime consumption hook for the ASK acquisition seam.
- It is default-dark.
- It preserves normal runtime behavior when disabled.
- It does not change public `chat(...)` signature.
- It does not change `ChatResponse`, `TurnEvent`, or telemetry schema.
- It does not call/render question prose.
- It does not serve from `proposal_path`.
- It does not retire Q1B carve-out or flip `proposal_allowed`.
- It does not serve VERIFIED.
- It does not move CLAIMS or metrics.
