A model-style proposer submits a claim, evidence bundle, and optional
bounded-inference block; CORE alone assigns the typed epistemic state
drawn from the canonical core.epistemic_state taxonomy (no parallel
enum) and emits a deterministic, replayable evidence artifact.
The proposer cannot set assigned_state, status, trace_hash,
authority_path, evidence_ledger, or normative_clearance: the closed
recursive schema rejects any root-level injection before state
evaluation runs, and proposer-supplied proposed_state/trace_hash are
recorded as ignored and never read.
Adds closed schema, six fixtures, pinned expected artifacts, a
double-run byte-identical runner with hardened output-dir policy, and a
22-test suite. No network, subprocess, eval/exec, model API, or side
effects beyond demo output.
A narrow, auditable proof path for the hybrid-mode boundary: a
Claude/Fable-style System 1 proposer submits an MCP-shaped tool call
(core.semantic_derivation.verify); CORE re-derives via the ADR-0184
derivation lane, keeps sole acceptance authority, refuses or asks when
it cannot honestly answer, and emits a deterministic replay/provenance
trace for every decision.
Boundary properties (each pinned by a failing-if-removed test):
- the proposer has no commit path: additionalProperties:false schema,
and the demo modules import nothing from generate.* (AST-scanned with
a planted-bypass self-test) — the lane is consumed only through the
ADR-0184 S4b audited trace facade;
- 'verified' requires pool commit AND clean commit-law/faithfulness
audits AND a gold-audited envelope.json entry AND byte-match to the
pinned derivation trace (measured: 118 of the off-serving pool's 231
corpus commits disagree with lane gold, so a bare pool commit is
never served — scenario s4 shows the refusal on a commit that even
matches gold);
- the ask leg is the real Q1 stack (router -> limitation -> Q1-D
producer -> carried handle -> gated serving), dark by default,
tamper-fail-closed on the content hash;
- authority_path names only consulted authorities; responses are
deterministic (double-run byte-identical) and pinned under expected/.
No serving/runtime change; no CLAIMS/metrics/telemetry/lane-pin
movement; no network or Anthropic API dependency (System 1 payloads are
clearly-labeled static fixtures).
